time-to-compromise metric