Hacking attacks on businesses are inevitable because hackers are constantly searching for weaknesses to exploit. However, many businesses still have inadequate response times and measures for handling such attacks, making it difficult to effectively manage these incidents. TrendMicro has been assisting customers with incident response for many years. In our experience, when an enterprise is hacked, the ability to respond quickly is crucial in controlling damage and achieving post-incident recovery. In this regard, two key indicators need to be evaluated: the time required to detect intrusions and the time required to complete investigations. My talk will explore why these two indicators may also fail to produce concrete results.