A SOC manager is building a quarterly board report on detection and response effectiveness. Over the quarter, alert volume grew 40% due to onboarding new log sources, and the team added several new detection rules. The board specifically wants to understand whether the SOC is getting better at limiting how long attackers operate undetected inside the environment before being caught and contained. Which single metric most directly answers the board's question?