Mean time to detect

Detecting faster genuinely shortens how long an attacker has to work, and a single average conceals almost everything.

One incident found in minutes and one found in nine months average out to something meaningless. The distribution matters, and so does the split between what was detected by your own tooling and what somebody told you about. A good average made up largely of external notifications is not a good result.