After closing a breach investigation, a CySA+ analyst is preparing a metrics report for leadership. The intrusion first occurred on March 3, the SIEM generated the first correlated alert on March 18, the SOC began active investigation on March 19, and the threat actor was fully evicted on March 22. Leadership wants a single metric that best expresses how long the adversary went undetected inside the environment, so future preparation investments can target that specific gap. Which metric should the analyst report to answer that question?