MM-ISAC Blog

Nobody Measures the MTTR of the Humans Who Respond to Incidents

Written by Steve Shelton | Jan 27, 2026 1:41:58 AM

In cybersecurity, we obsess — rightly — over Mean Time to Recovery (MTTR).

When a system goes down, when production is impacted, when safety, availability, or integrity is threatened, we measure how long it takes to recover. We instrument it. We report it. We optimize it.

But there’s one MTTR almost no organization measures:

The MTTR of the humans who respond to those incidents.

How long does it take your security team — or you — to recover cognitively, emotionally, and physically after a high-pressure incident, outage, breach, or operational disruption?

Not how long it takes to get back to “functioning.”
But how long it takes to get back to clear, calm, and effective.

That metric is what I call H-MTTR: Human Mean Time to Recovery — and in today’s cyber-physical, safety-critical, always-on environments like metals and mining, it may be one of the most important performance indicators you’re not tracking.

Cybersecurity Burnout Is No Longer a People Problem — It’s a Systems Problem

Cybersecurity stress and burnout are no longer fringe issues. They’re now structural risks.

In the 2025 State of Stress in Cybersecurity research that Green Shoe Consulting conducted with 40 CISOs across industries, we asked a simple question:

“How long does it take you to recover after a major stressful incident?”

The most striking finding wasn’t the answers.

It was that 94% of the CISOs said they had never even thought about the question before.

Not because they don’t experience stress.
Not because they don’t feel the impact.
But because we’ve never been taught to measure human recovery the way we measure technical recovery.

We monitor:

  • System uptime
  • Patch latency
  • Incident response time
  • Downtime cost
  • Production loss

But we almost never monitor:

  • Cognitive fatigue
  • Emotional load
  • Recovery time after crisis
  • Depletion across long incident chains
  • The cumulative toll of “always being on”

And in environments like metals, mining, and critical infrastructure — where cybersecurity incidents are intertwined with physical operations, safety risks, environmental exposure, and regulatory pressure — the cost of depleted humans is not abstract. It’s operational.

Why H-MTTR Matters (Especially in Industrial Environments)

In high-risk, high-reliability industries, performance is not just about tools — it’s about people under pressure.

Long H-MTTR (slow human recovery) shows up as:

  • Slower decision-making
  • Reduced situational awareness
  • Higher error rates
  • Shorter emotional fuse
  • Increased conflict
  • Talent attrition
  • Quiet disengagement
  • Burnout that looks like “normal fatigue” until someone leaves or breaks

Short H-MTTR (fast human recovery) looks like:

  • Better judgment under stress
  • Higher resilience during prolonged incidents
  • More stable leadership presence
  • Healthier team culture
  • Stronger retention
  • More sustainable performance

In other words:

H-MTTR is a leading indicator of engagement, productivity, and retention.

If you shorten recovery time, you don’t just reduce burnout — you improve performance.

A Simple Way to Define Your Current H-MTTR

You don’t need a complex assessment to start.

Here’s a simple way anyone reading this can define their current H-MTTR:

Step 1 — Think back to your last major stressful event.
A cyber incident. A production disruption. A safety escalation. A regulatory crisis. A prolonged high-pressure period.

Step 2 — Ask yourself:

“How long did it take before I actually felt like myself again — clear, calm, and effective?”

Not “functional.”
Not “caught up on email.”
But genuinely recovered.

Your answer will usually fall into one of these ranges:

  • Less than 24 hours
  • 1–3 days
  • 4–7 days
  • 1–2 weeks
  • More than 2 weeks

That’s your current H-MTTR.

Then ask:

  • What slowed that recovery?
  • What helped shorten it?

That reflection alone often reveals more than people expect.

Why Measuring H-MTTR Changes Behavior

Measurement changes culture.

The moment leaders begin to acknowledge that:

  • Humans have recovery curves
  • Cognitive and emotional load accumulate
  • Recovery is not automatic
  • Recovery can be trained, supported, and designed for

…the conversation shifts.

From:
“People just need to be tougher.”

To:
“How do we design systems, rhythms, and leadership behaviors that support sustainable performance?”

That shift is where engagement improves.
That’s where retention improves.
That’s where resilience stops being a buzzword and becomes an operational capability.

Final Thought

We don’t measure MTTR because we love metrics.

We measure it because we know recovery time predicts reliability.

The same is true for humans.

In a world where cyber incidents intersect with physical operations, safety, production, and national infrastructure, the resilience of the people doing the work is not a “nice to have.”

It’s part of the system.

And systems perform better when we measure what matters.

Steve Shelton is the Founder and Chief Resilience Officer of Green Shoe Consulting, where he works with cybersecurity leaders and teams to reduce burnout, build resilience, and design sustainable high-performance cultures.