About Time to Contain
Incident response automation platforms scored on the public evidence for how fast and how safely they contain an attack.
What this publication is
Time to Contain is a ranked buyer's guide to security incident response automation platforms. It is organised around one metric. Time to contain is the time from the first detection signal to the first action that stops the attacker. It is not the time to close a ticket and not the time to resolve the incident.
Fourteen platforms are scored on eight published criteria. The largest, at 25 percent of the total, is native containment coverage, measured by the containment coverage scorecard: 25 actions across EDR, identity, email, cloud and network, checked against each vendor's own documentation. The other seven criteria are published time-to-contain evidence with its method, approval, rollback and blast-radius controls, the explanation and audit trail, integration depth, detection-to-response coupling, pricing transparency, and deployment and data handling. The rubric page lists the weights and what each status means.
Each criterion is scored from 0 to 10 from pages the vendor controls: documentation, product pages, release notes and pricing pages. Every vendor fact on the site carries its source link and the date it was read. A vendor's statement about itself is labelled a vendor claim. A vendor claim can earn credit for a design or a control, but an outcome number such as accuracy, closure rate or response time earns only partial credit unless the method is published. Nobody scores 10. The ceiling is 9.5, and anything above 9.0 needs a second source.
Totals are computed in code from the weights, and each published total equals the sum of its parts. Where neighbouring totals have no gap above 0.25 between them, the page calls the run a band, not a ladder. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order. Where a score rests on a marketing page only, the profile says so, because a read of the vendor's documentation can move it. A status of not documented is a finding about public material. It is not a claim that the capability is missing.
The scope is security incident response. IT incident management tools such as PagerDuty and incident.io are out of scope, because they route on-call alerts and run service incidents, and they do not take containment actions against an attacker.
To send a correction, write to editor@timetocontain.com with the page, the sentence and a link to a page the vendor controls. Corrections are logged with their dates. Vendors cannot pay to change a score. A score changes only when the evidence on a vendor-controlled page changes, or when we find we read it wrongly.