is reducing mean time to respond to security incidents even a meaningful metric to optimize for?

Mttr assumes faster response is always better, but there are definitely scenarios where taking more time to respond carefully is preferable to responding quickly but incorrectly. If fast response means making containment decisions without proper investigation, you might miss lateral movement or fail to eradicate the attacker completely. The other issue is that it averages across all incidents, so improving response time for trivial incidents brings the metric down without actually addressing the challenging cases that matter most.