Design Pattern · 2026-09-15
Measure the time between each response step
Incident counts depend on how hard an organisation looks. Detection, containment, and recovery intervals can be generated on demand and compared over time.
Under the pillar Attack-and-recovery engineering
The pattern
Do not wait for incidents to produce metrics. Inject known, safe activity that a control claims to detect, and measure the interval to alert, to accurate understanding, and to containment action. Repeat on a schedule with varied techniques.
The resulting numbers are comparable quarter to quarter, which incident counts are not.
Put this to work
Measure the time between each response step application record
Apply Measure the time between each response step to a real piece of work and record what happened.
- For
- Practitioners, researchers, founders, and operating leaders.
- What you keep
- A measure the time between each response step application record you can review, revise, and send.
- What counts as sound
- Names a real setting
- Shows the work before and after
- Records exceptions
- Uses an observable result
- Ends with keep, revise, or stop
The result is a working analysis. Check it against source evidence and qualified judgment.
Nothing entered here is stored or sent. Review the prompt before sharing confidential, personal, patient, or privileged information.
Review the prompt
You can leave any field blank. The prompt will mark it as not provided.
If the record survives your review, send the question, evidence, unknowns, and requested next step.