Encountering hacking attacks is an unavoidable reality nowadays. Unfortunately, the response times and countermeasures deployed by most businesses are insufficient, making it difficult to efficaciously handle hacker intrusion incidents. In this talk, I will explore two effective indicators: the time required to detect intrusions and the time required to complete investigations, both of which can facilitate strengthening the response capability of enterprises.