Time to Contain

Incident response automation, ranked by what it can contain

Time to contain is the time from the first detection signal on an incident to the first action that stops the attacker spreading or acting. It is not the time to close the ticket.

IT incident management tools such as PagerDuty and incident.io, which route on-call alerts and run service incidents, are out of scope.

2 of 14publish a time to contain

The ranked table

Rubric version 2026.11, read 2026-11-03. How scores are set.

  1. 1D3 Security19 of 25 actions documented4 to 8 minutes, vendor claim, grade C. Clock starts at plan approval7.08
  2. 2Cyware17 of 25 actions documentedno published figure6.11
  3. 3Google Security Operations19 of 25 actions documentedno published figure6.09
  4. 4Palo Alto Cortex XSOAR20 of 25 actions documentedno published figure5.91
  5. 5Swimlane (Turbine)18 of 25 actions documentedunder 5 minutes, customer claim, grade C5.84
  6. 6Splunk SOAR (Cisco)19 of 25 actions documentedno published figure5.79
  7. 7Torq13 of 25 actions documentedno published figure5.74
  8. 8Tines22 of 25 actions documentedno published figure5.62
  9. 9Microsoft Sentinel9 of 25 actions documentedno published figure5.14
  10. 10Dropzone AI2 of 25 actions documentedno published figure5.00
  11. 11=Prophet Security0 of 25 actions documentedno published figure4.87
  12. 11=Mate Security0 of 25 actions documentedno published figure4.87
  13. 13ServiceNow Security Operations7 of 25 actions documentedno published figure4.16
  14. 14CrowdStrike Falcon Fusion SOAR0 of 25 actions documented, docs behind loginno published figure3.49

Bars start at detection unless the label says otherwise: the one outlined bar, D3 Security, is a vendor figure whose clock starts at plan approval, so it excludes analyst review time before that point. The first bar runs to the time to contain the vendor publishes, on a scale of 0 to 10 minutes. A short open red stub at 0 means no figure is published; it is not a time. The thin bar is the share of 25 containment actions documented. The number at the right is the total score out of 10.

Shaded rows are bands: a band is a run of neighbouring totals with no gap of more than 0.25 between one and the next, not a ladder. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order. Cyware and Tines are 0.49 apart and share a band only because no neighbouring gap between them exceeds 0.25.

11=of 14

Where Mate Security sits

Mate Security is 11th of 14, tied with Prophet Security, at a total of 4.87. Its public pages document 0 of 25 containment actions, so its coverage score is 2.0 of 10. mate.security, read Scorecard

On the seven criteria other than coverage, Mate scores 5.83. Coverage carries 25 percent of the total, and a score of 2.0 takes its total to 4.87. This is a finding about public material. Mate's pages name no supported containment action for any tool, so none counts. It is not a claim that Mate cannot take these actions. The reasons, criterion by criterion, are on Mate Security's profile.

2 of 14platforms with a figure

What the published figures show

2 of 14 platforms publish a time-to-contain figure of any kind: D3 Security (4 to 8 minutes) and Swimlane (Turbine) (under 5 minutes). D3 Security's is a vendor claim and Swimlane (Turbine)'s is a customer claim, with no sample size, so both are grade C. The rest publish nothing on containment time, or publish adjacent numbers such as mean time to respond or time saved, which are not the same clock. The evidence register lists every figure found, including managed services, which are shown as services and never ranked against platforms.

Fix the clock before you compare any two numbers. The guide on reading a vendor's response-time number says how.

Bands, not a ladder

Totals are computed in code from the published weights, and each total equals the sum of its eight weighted parts. The table cuts bands in one place. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.

  • Cyware, Google Security Operations, Palo Alto Cortex XSOAR, Swimlane (Turbine), Splunk SOAR (Cisco), Torq, Tines: totals from 5.62 to 6.11, no gap above 0.25.
  • Microsoft Sentinel, Dropzone AI, Prophet Security, Mate Security: totals from 4.87 to 5.14, no gap above 0.25.

Pick by buyer type when the bands are close: the five buyer-type rankings reweight the same rubric. Compare any two platforms on the head-to-head pages, or read the whole containment coverage scorecard of 25 actions.

The scorecard, the evidence register and the scores are free to download as CSV and JSON under CC BY 4.0.