A SOC manager reviews quarterly incident response metrics and notices that while alerts are being detected quickly, the average time from confirmation of an incident to full remediation has grown from 4 hours to 11 hours over three months. The manager wants to select the single metric that best quantifies this specific problem so the team can track improvement in how fast incidents are resolved. Which metric should the manager focus on?