How CrowdStrike Detects and Disrupts Insider Threats (2026)

Insider threats represent one of the most challenging security problems organizations face today. Unlike external attackers who must breach perimeter defenses, insiders already have legitimate access to critical systems, data, and networks. This fundamental advantage makes them difficult to detect and exceptionally dangerous once they turn malicious. CrowdStrike’s approach to insider threat detection and disruption combines behavioral analytics, identity monitoring, and integrated endpoint visibility to catch these threats before they cause significant damage. This comprehensive guide explores how CrowdStrike detects, investigates, and stops insider threats in real-world environments.

Understanding the Modern Insider Threat Landscape

The insider threat problem has fundamentally changed over the past five years. Traditional security models assumed that insiders were homogeneous in their behavior and motivations, but modern enterprise environments present far more complexity. Today’s workforce includes permanent employees, contractors, temporary staffing, vendors with system access, and automated service accounts. Each category presents different risk profiles and detection challenges. An accidental exposure by a well-meaning employee responding to a phishing attack differs substantially from a malicious insider systematically exfiltrating intellectual property, yet both register as insider threats within your organization.

The proliferation of cloud services, remote work infrastructure, and SaaS applications has dramatically expanded the attack surface that insiders can exploit. An insider no longer needs physical proximity to company servers to cause damage. They can access sensitive data from home, upload files to personal cloud storage, or steal credentials that grant them ongoing access long after their employment ends. The boundary between authorized access and unauthorized activity has become increasingly blurred, especially in environments where employees use personal devices for work or access company resources through third-party applications.

Defining Insider Threats with Precision

An insider threat occurs when an individual with legitimate access to organizational systems, data, or networks intentionally or unintentionally causes harm or increases security risk. The critical distinction here is authorization: insiders possess legitimate access that authorized personnel granted them. This differentiates them from external attackers who must circumvent security controls to gain initial access. Insider threats encompass:

• Malicious insiders who intentionally steal data, sabotage systems, or cause operational disruption for financial gain, revenge, or espionage
• Negligent employees who inadvertently expose sensitive information through misconfiguration, insecure practices, or failure to follow security policies
• Compromised insiders whose credentials have been stolen by external threat actors who now use legitimate access to further their objectives
• Unwitting insiders who have been manipulated through social engineering, blackmail, or coercion into performing malicious actions
• Legacy access insiders including former employees, terminated contractors, or departed partners whose access was never properly revoked

The complexity here is that each category requires different detection approaches. Detecting a disgruntled employee preparing to steal trade secrets looks different from identifying a compromised account being abused by external attackers. CrowdStrike’s detection framework must account for these variations while maintaining practical alert thresholds that prevent security teams from drowning in false positives.

Evolution of Insider Threat Tactics

Insider threat tactics have become substantially more sophisticated as threat actors recognize the unique advantages of insider access. Early insider threat cases involved relatively simple file copying to USB devices or sending emails to personal accounts. Contemporary insider threat actors employ advanced techniques including:

Credential harvesting and abuse: Insiders collect credentials from multiple sources including hardcoded secrets in code repositories, shared password managers, documentation, or surveillance of colleague activity. They systematically test these credentials across high-value systems to identify access opportunities. Once obtained, they use these credentials to perform actions that cannot be attributed to their primary account, creating plausible deniability.

Lateral movement and privilege escalation: Rather than immediately exfiltrating data, sophisticated insiders perform reconnaissance and lateral movement to identify the most valuable assets. They exploit weak segmentation, over-provisioned permissions, or unpatched systems to escalate privileges and access restricted systems. This approach maximizes their ability to target high-value data and reduces detection risk by spreading activity across multiple accounts and systems.

Collaboration with external actors: Advanced insider threat campaigns involve coordination between internal conspirators and external threat groups. An insider might provide initial access credentials, security architecture details, or specific targeting information to external attackers who then execute the main attack. This hybrid approach combines the insider’s knowledge advantage with external attackers’ specialized capabilities.

Anti-forensics and evasion: Sophisticated insiders employ techniques to obscure their activities including clearing logs, disabling endpoint detection controls, using encrypted communication channels, or timing data exfiltration during peak network activity when anomalies are less visible. Some insider threats intentionally generate noise and false alerts to overwhelm security teams and obscure genuine malicious activity.

CrowdStrike Falcon’s Behavioral Detection Architecture

CrowdStrike’s approach to insider threat detection fundamentally differs from traditional rule-based security systems. Rather than defining exhaustive lists of prohibited activities and alerting on any match, CrowdStrike builds dynamic behavioral baselines for each user and system. The platform learns normal patterns of activity, then identifies statistically significant deviations that might indicate compromise or malicious activity. This approach proves far more effective at detecting novel threats and reducing false positives compared to static rule-based approaches.

User and Entity Behavior Analytics (UEBA)

User and Entity Behavior Analytics represents the foundation of CrowdStrike’s insider threat detection. UEBA systems analyze hundreds of behavioral signals including login patterns, file access, application usage, network connections, and data interactions. The system establishes baselines for normal user behavior by analyzing historical activity patterns. These baselines account for variations in user behavior across different days of the week, times of day, and seasonal variations. Once baselines are established, the system flags activities that statistically deviate from normal patterns.

UEBA systems excel at detecting threat patterns that would appear innocuous in isolation but reveal malicious intent when examined holistically. For example, a single instance of accessing a file outside normal job responsibilities might be unremarkable. However, a pattern of such access combined with unusual data transfers, downloads to personal devices, or communication with external accounts creates a compelling narrative of potential data exfiltration. CrowdStrike’s UEBA engine correlates these signals across multiple dimensions to identify threats with high confidence.

Key behavioral indicators tracked include:

• Authentication patterns including login times, geographical locations, device types, and authentication methods used to access systems
• File and data access patterns including which files are accessed, how frequently, the quantity of data transferred, and transfers to external systems
• Network activity including connection destinations, protocols used, data volumes, and timing patterns relative to normal user activity
• Application usage patterns including which applications are launched, frequency of use, and interactions with sensitive functions or data exports
• System configuration changes including privilege modifications, security control alterations, and system administration activities outside normal scope
• Communication patterns including email recipient analysis, messaging frequency, and communication with external parties

Machine Learning and Anomaly Detection

Modern insider threat detection requires machine learning capabilities that can identify complex patterns across enormous datasets. CrowdStrike employs multiple machine learning models that work in concert to identify suspicious activities. These models move beyond simple statistical deviation detection to identify more nuanced threat patterns.

Unsupervised learning models identify unusual patterns without relying on labeled training data showing examples of malicious activity. These models prove particularly valuable for detecting novel attacks that don’t match historical patterns. Supervised learning models trained on known insider threat cases help identify patterns that specifically correlate with malicious insider activity. Ensemble methods combine predictions from multiple models to improve accuracy and reduce false positives.

CrowdStrike’s machine learning pipeline continuously retrains models as new data becomes available, ensuring detection capabilities adapt to evolving threat tactics. The system also incorporates feedback from security analysts who investigate alerts, using this validation data to improve model accuracy over time. This creates a virtuous cycle where the system becomes progressively better at distinguishing genuine threats from benign anomalies.

Process and File Activity Monitoring

CrowdStrike Falcon’s endpoint agent provides deep visibility into process and file activity on protected endpoints. At the process level, the agent monitors every process execution including command-line arguments, child processes, and network connections. This visibility allows detection of suspicious activity including launching archiving tools to prepare data for exfiltration, enabling credential-dumping utilities, or disabling security controls.

File activity monitoring tracks access patterns to sensitive files and directories. The system observes which processes access files, what operations are performed (read, write, delete, copy), the timing and frequency of access, and whether data is transferred outside the organization. This granular visibility enables detection of data exfiltration attempts even when attackers use legitimate tools like cloud sync applications or FTP clients.

The combination of process and file monitoring proves particularly valuable for detecting insider threats because it reveals intent through activity sequences. An employee legitimately accessing sensitive files as part of their job role appears unremarkable. However, when that access is immediately followed by compression, encryption, or transfer to external locations, the activity sequence reveals likely malicious intent.

Identity and Credential Monitoring for Insider Threats

Identity has become the new perimeter in modern security architectures. Because insider threats frequently involve identity compromise or misuse of legitimate credentials, comprehensive identity monitoring represents a critical component of insider threat defense. CrowdStrike’s identity protection capabilities monitor authentication activity, credential exposure, and privilege misuse across your entire infrastructure.

Anomalous Login Detection

Login patterns provide rich signals for detecting both compromised accounts and potential insider threats. CrowdStrike monitors multiple dimensions of authentication activity to identify anomalous patterns:

Login Anomaly Type	Detection Method	Threat Indicator
Impossible travel	Detects logins from geographically distant locations within physically impossible timeframes	Account compromise or credential sharing
Time-of-day anomalies	Identifies logins outside normal hours for specific users, especially at 3 AM or weekends for office workers	Authorized insider activity or unauthorized access
Device anomalies	Flags logins from unfamiliar devices, operating systems, or device types not typically used by the user	Credential compromise or unauthorized account access
Brute-force attacks	Detects multiple failed authentication attempts against a single account or across multiple accounts	Insider attempting to access accounts outside their authorization scope
Frequency anomalies	Identifies unusual login frequency compared to historical baselines	Automated access or reconnaissance activity

The power of identity anomaly detection lies in the integration of multiple signals. A single unusual login might be benign (legitimate travel, new device), but multiple anomalies in combination create a compelling indication of account compromise. CrowdStrike’s system evaluates contextual factors including whether the user recently changed their password, whether they accessed sensitive systems, and whether the activity matches historical patterns for that specific user.

Privilege Escalation Monitoring

Many insider threat attacks involve lateral movement and privilege escalation to access restricted systems. Insider threats often have legitimate access to standard business systems but require elevated privileges to access highly sensitive data or infrastructure. CrowdStrike monitors privilege escalation activities across your environment including:

• Sudo and administrative command execution on Unix/Linux systems, particularly unusual or rare administrative commands run by standard user accounts
• Windows privilege escalation including UAC (User Access Control) bypasses, token elevation requests, and access to restricted administrative tools
• Cloud privilege escalation including assumption of privileged roles in AWS, Azure, or Google Cloud, particularly when those privileges are outside the user’s normal responsibilities
• Database direct privilege escalation including DBA role assumption, schema modifications, or direct data access outside normal application interfaces
• Active Directory and identity platform privilege escalation including temporary administrative access, delegation modifications, or permission changes

The context matters significantly here. A system administrator executing sudo commands represents normal activity. However, a financial analyst executing the same commands raises immediate concerns. CrowdStrike’s system accounts for role-based expectations and flags privilege escalation when users access privileges outside their normal scope.

Credential Exposure and Dark Web Monitoring

Insiders frequently expose credentials that enable ongoing access or facilitate attacks. CrowdStrike monitors for credential exposure including hardcoded API keys in code repositories, database connection strings in configuration files, and authentication tokens in chat messages. Additionally, CrowdStrike monitors dark web sources and underground forums where stolen credentials are traded. When company credentials appear for sale or discussion, this represents a critical indicator that employees may be selling access or that accounts have been compromised.

Early credential exposure detection enables organizations to rotate credentials and revoke access before insiders or external actors exploit them. This proactive approach proves far more effective than reactive response after credentials have been abused.

Real-Time Detection and Disruption Capabilities

Detection alone provides insufficient defense against insider threats. Once malicious activity is identified, organizations must respond rapidly to minimize impact. CrowdStrike combines detection with automated disruption capabilities that enable immediate response without waiting for human investigation.

Immediate Alert Generation and Prioritization

When CrowdStrike Falcon detects suspicious activity, alerts are generated immediately with severity classifications that guide analyst response. Rather than presenting a flat list of alerts, CrowdStrike’s system prioritizes alerts based on threat severity, asset criticality, and context. A low-confidence anomaly in a non-sensitive system receives lower priority than high-confidence indicators of data exfiltration involving critical intellectual property.

Alert quality represents a critical consideration in insider threat programs. Security teams investigating alerts represent your organization’s most expensive security resource. Wasting analyst time on false positives directly reduces your capacity to investigate genuine threats. CrowdStrike’s prioritization system enables analysts to focus on high-fidelity alerts that warrant immediate investigation.

Each alert includes contextual information including relevant user history, similar activities detected on other accounts, relevant network activity, file access patterns, and available threat intelligence. This context accelerates investigation by providing analysts with relevant information immediately rather than requiring manual correlation across multiple tools.

Automated Endpoint Isolation

When high-confidence insider threat activity is detected, CrowdStrike can automatically isolate the affected endpoint from network access. Endpoint isolation prevents lateral movement, stops data exfiltration, and terminates communications with command and control infrastructure. The isolation occurs at the Falcon agent level, meaning that even if the user attempts to work around security controls, network connectivity remains restricted.

Isolation preserves evidence and allows controlled investigation. Unlike remote disabling or system shutdown, isolation allows investigators to examine the system state at the moment malicious activity was detected. Analysts can examine running processes, file system state, memory contents, and network connections to fully understand what transpired. Once investigation completes, access can be restored or systems can be rebuilt as needed.

Automated Account Suspension and Credential Revocation

For compromised accounts or accounts exhibiting severe malicious activity, CrowdStrike can automatically trigger account suspension or password resets. This capability extends across on-premises Active Directory environments and cloud identity platforms including Azure Active Directory and Okta. Automated account suspension immediately prevents further abuse while minimizing business disruption compared to waiting for security team response.

The system can be configured with specific criteria for automatic suspension including multiple failed authentication attempts from impossible locations, access to highly sensitive systems outside normal scope, or sustained data exfiltration activity. This allows organizations to define thresholds that represent unambiguous threat indicators warranting immediate response.

Malicious Process Termination

CrowdStrike Falcon can terminate malicious processes identified on protected endpoints. When the platform detects execution of known malware, credential-dumping utilities, data archiving tools, or other suspicious processes, it can immediately kill the process and prevent reexecution. This prevents malware persistence, stops active data exfiltration, and disables tools that insiders might use to further their objectives.

Process termination occurs at the kernel level through the Falcon sensor, meaning that user-level attempts to restart the process or disable controls are ineffective. This automated response provides immediate disruption of active attacks without requiring endpoint owner cooperation.

Integrated Visibility Across Your Security Infrastructure

Insider threats often involve activity across multiple systems and security layers. An insider might access sensitive data through cloud applications, communicate using messaging platforms, and exfiltrate data through cloud storage services. Detecting this threat requires visibility across endpoints, identity systems, cloud applications, and network infrastructure. Fragmented visibility across disconnected tools makes comprehensive threat detection nearly impossible.

Endpoint, Identity, and Cloud Convergence

CrowdStrike’s architecture integrates visibility from three critical security domains: endpoints, identity, and cloud. This convergence enables correlation of suspicious activities across these domains.

Endpoint visibility provides process and file-level activity on systems where insider threats might operate. This reveals what applications are executed, files accessed, and data transferred. Endpoint visibility alone cannot determine whether file access represents normal job activity or data exfiltration.

Identity visibility provides context about user roles, responsibilities, group memberships, and authorized access levels. Identity data reveals what systems and data a user should legitimately access. Comparing endpoint activity against identity-defined authorization reveals access outside normal scope.

Cloud visibility reveals activity in SaaS applications, cloud infrastructure, and third-party services. Increasingly, insiders exfiltrate data through cloud services rather than direct file copies. Cloud visibility detects access to sensitive data through Salesforce, unusual AWS API calls, or suspicious file uploads to personal cloud storage.

By combining these three domains, CrowdStrike can detect threats that would remain invisible with single-domain visibility. An unusual file access detected at the endpoint level becomes highly suspicious when correlated with cloud storage uploads and communication with external parties identified through identity activity.

Threat Intelligence Integration

CrowdStrike’s threat intelligence operations continuously monitor emerging threats, attack campaigns, and threat actor capabilities. This intelligence informs insider threat detection by providing indicators of compromise, attack patterns, and threat actor objectives. When intelligence indicates that a particular threat group is targeting intellectual property in your industry, detection rules can be tuned to identify activities that match these threat patterns.

Threat intelligence also informs customer communications. When intelligence indicates that specific credentials or systems have been compromised in industry-wide attacks, CrowdStrike can alert customers to investigate specific accounts or systems potentially affected.

Data Lake and Investigation Capabilities

CrowdStrike Falcon maintains comprehensive activity logs from all protected systems in a centralized data lake. This historical data enables retrospective investigation of insider threats. Once a threat is identified, security teams can query activity logs to understand the full scope and timeline of malicious activity. This forensic capability supports not only security response but also potential legal proceedings against insider threat actors.

The data lake enables investigation of questions including which files were accessed by a particular account, what processes executed on a system during a specific timeframe, and what data was transferred to external locations. This forensic completeness supports comprehensive understanding of insider threat incidents.

Practical Implementation of Insider Threat Detection

Understanding CrowdStrike’s capabilities is necessary but insufficient for effective insider threat defense. Organizations must thoughtfully implement detection capabilities, define policies appropriate to their risk environment, and establish processes for investigating and responding to alerts.

Baseline Development and User Profiling

Effective behavioral analysis requires comprehensive baseline data representing normal user activity. During initial implementation, CrowdStrike Falcon collects activity data for two to four weeks before enabling behavioral-based detections. This observation period allows the system to learn patterns including typical file access, authentication locations, application usage, and network connectivity.

User role is critical context for baseline development. A database administrator should access databases frequently and execute administrative commands regularly. A marketing analyst performing the same activities would represent suspicious behavior. CrowdStrike’s system incorporates user role and department information to establish context-appropriate baselines. Organizations should ensure that user role data is accurate and current in their directory services, as this directly impacts detection accuracy.

Seasonality considerations matter as well. Users may have different activity patterns during fiscal year-end closing, marketing campaign launches, or other cyclical business events. CrowdStrike’s system accounts for these variations to reduce false positives during legitimate business activity spikes.

Policy Configuration and Alert Tuning

CrowdStrike provides extensive policy configuration options enabling organizations to tailor detection to their specific risk profiles and business requirements. Different organizations have vastly different security requirements. A financial institution handling customer assets requires stricter insider threat policies than a consulting firm. A government contractor handling classified information requires different detection tuning than a retail organization.

Effective policy configuration involves collaboration between security teams and business stakeholders. Security teams understand detection capabilities and threat landscapes. Business stakeholders understand operational requirements and realistic user behaviors. Policies developed collaboratively tend to be more effective than policies designed in isolation by security teams.

Alert tuning is iterative. Initial policy configurations should be conservative, favoring detection over false positive reduction. As security teams investigate alerts and understand which alerts correlate with genuine threats and which represent benign activity, policies can be refined to improve signal-to-noise ratios.

Investigation Workflows and Response Procedures

Even with automated detection and disruption capabilities, insider threat response requires skilled investigators. Effective organizations establish clear investigation workflows including initial alert assessment, evidence collection, stakeholder notification, and escalation procedures. Investigation workflows should address questions including:

• Is the alert a true positive threat or a benign anomaly? This determination requires analysis of context and behavioral patterns
• What is the scope of the threat including which accounts, systems, or data have been affected?
• How long has the malicious activity been occurring? Determining the timeline helps identify what data or systems were exposed
• Should the user’s account be suspended immediately, or should activity be monitored to gather additional evidence?
• What legal or compliance obligations require notification to regulators, law enforcement, or affected parties?
• What forensic evidence must be preserved for potential legal proceedings?

Clear procedures prevent investigators from second-guessing decisions during active incidents and ensure consistent handling of similar situations across the organization.

Real-World Insider Threat Case Studies

Case studies illustrate how CrowdStrike’s capabilities translate to actual threat detection and response in production environments. While specific customer details cannot be disclosed due to confidentiality agreements, representative scenarios demonstrate detection capabilities.

Data Exfiltration Prevention: Financial Services

A financial services firm implemented CrowdStrike Falcon to monitor access to customer account information and trading data. Within weeks of implementation, the behavioral analysis system detected unusual activity from a senior trader account. The account showed normal activity during business hours but accessed unusual files outside trading scope, particularly customer contact information and account details. The account subsequently initiated large file transfers to personal cloud storage.

CrowdStrike’s system correlated the unusual file access pattern with the cloud transfer activity and flagged the account as high-risk. Security team investigation revealed that the trader had been systematically collecting customer information to establish his own independent trading firm. The account was immediately suspended, preventing the trader from accessing additional customer data. The organization assessed the scope of leaked information and notified affected customers in accordance with regulatory requirements. Without the behavioral analysis providing early detection, the trader would have accessed significantly more customer data before the organization discovered the threat through other means.

Credential Compromise Detection: Healthcare

A healthcare organization using CrowdStrike Falcon detected impossible travel alerts on a clinical staff member’s account. The account logged in from the user’s normal facility location, then minutes later appeared to log in from a location thousands of miles away accessing patient record systems. The timing made physical travel impossible, indicating either account compromise or credential sharing.

Investigation revealed that a former employee with legitimate access credentials had not returned them before employment termination. An external actor had subsequently obtained those credentials and was using them to access patient records. The healthcare organization immediately revoked the former employee’s credentials and conducted a forensic investigation to determine what patient records were accessed. CrowdStrike’s identity anomaly detection provided the early warning that prevented months of undetected unauthorized access.

Insider Reconnaissance: Technology Company

A software development company detected unusual reconnaissance activity on a senior engineer’s account. The account accessed source code repositories and system documentation far outside the engineer’s normal responsibilities. File access patterns showed the engineer reviewing security architecture, access control systems, and vulnerability disclosure processes. These activities suggested reconnaissance in preparation for more significant malicious activity.

The engineer’s communications were placed under additional scrutiny, revealing coordination with external parties interested in acquiring proprietary technology. The organization terminated the employee immediately and engaged law enforcement. CrowdStrike’s process and file monitoring demonstrated the engineering decisions and code this individual accessed, supporting legal proceedings against both the insider and the external parties attempting to acquire trade secrets.

Advanced Insider Threat Mitigation Techniques

Beyond detection and immediate response, organizations can employ additional techniques to comprehensively defend against insider threats. These techniques reduce insider threat risk across the entire threat lifecycle.

Simulated Insider Threat Exercises

Organizations conducting mature insider threat programs conduct regular exercises simulating insider threats and evaluating response capabilities. These exercises involve authorized personnel performing legitimate actions that mimic insider threat tactics including accessing sensitive files, attempting to exfiltrate data, or disabling security controls. Exercises allow organizations to test whether detection systems identify these activities and whether response procedures function effectively.

Simulated exercises differ fundamentally from penetration tests. Penetration testers evaluate external security by attempting to breach defenses from outside. Insider threat exercises evaluate insider threat defenses from the perspective of authorized users with legitimate system access. Exercises might involve attempting to copy sensitive files to personal devices, upload data to personal cloud storage, or access systems outside normal job responsibilities.

Successful exercises validate detection and response capabilities. Failed exercises identify gaps requiring remediation. An exercise where simulated insider activity went undetected for extended periods indicates that detection baselines require tuning, policies require refinement, or additional monitoring tools require deployment.

Secrets Detection and Management

Exposed secrets including API keys, database passwords, and authentication tokens enable insider threats and account compromise. Insiders frequently discover secrets in code repositories, configuration files, documentation, or shared credentials stores. Once discovered, these secrets provide persistent access even if the insider’s primary account is disabled.

Comprehensive secrets management involves multiple components. Secrets detection scans code repositories, configuration management systems, and collaboration platforms for exposed credentials. CrowdStrike and third-party tools including GitGuardian, TruffleHog, and Delinea provide secrets detection capabilities. Detected secrets should trigger immediate credential rotation and investigation of whether the exposed secret was accessed or abused.

Secrets management systems including HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault provide secure storage for authentication credentials. Applications retrieve secrets from these systems at runtime rather than reading hardcoded credentials from configuration files. This architectural change prevents credential exposure in the first place.

Personnel should receive training on secure credential management, understanding that sharing passwords or embedding credentials in code represents significant security risks. Organizations should enforce policies prohibiting credential sharing and regular auditing of credentials to identify accounts using shared passwords.

Data Classification and Access Control

Comprehensive insider threat defense requires understanding what data requires protection and who legitimately needs access. Data classification assigns labels to data based on sensitivity including public, internal, confidential, and restricted categories. Access control systems restrict access to classified data based on user role and need-to-know.

CrowdStrike’s detection systems become more effective when they understand data sensitivity. Unusual access to confidential or restricted data triggers investigation even when the access pattern might be normal for standard data. Conversely, unusual access to public data merits lower concern.

Implementing effective access control systems requires substantial effort including data mapping to identify where sensitive data resides, access requirement analysis to determine who needs access, and system configuration to enforce controls. However, this investment reduces insider threat risk significantly by limiting the data even compromised insiders can access.

Measuring Insider Threat Defense Effectiveness

Effective security programs measure outcomes to demonstrate value and identify improvement areas. Insider threat defense effectiveness can be measured through several metrics:

Mean time to detect (MTTD) and mean time to respond (