{
  "name": "Time to Contain published time-to-contain evidence register",
  "read": "2026-11-04",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "grading": {
    "A": "Independent measurement with method published.",
    "B": "Vendor-measured, with sample and method published.",
    "C": "Vendor number without method.",
    "D": "Unverifiable, unreadable or contradicted."
  },
  "labelling_rule": "Items with kind 'service' are managed detection and response services. They are comparison anchors, not platforms, and are never ranked against the platforms.",
  "items": [
    {
      "subject": "CrowdStrike Falcon Complete",
      "kind": "service",
      "platform_slug": null,
      "metric": "mttc",
      "figure": "1 minute, median time to contain",
      "sample": "not published",
      "who_measured": "vendor",
      "date": "not stated on page; page references the 2026 Global Threat Report and 2026 content",
      "source": "https://www.crowdstrike.com/en-us/services/falcon-complete-mdr/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "Footnote defines MTTC as the time from initial detection to successful containment controls on an endpoint, covering automation, platform enforcement and expert operations, and says results vary with offline hosts. The footnote gives no sample size, period or customer count, and the figure belongs to a managed service rather than a platform."
    },
    {
      "subject": "CrowdStrike Falcon Complete",
      "kind": "service",
      "platform_slug": null,
      "metric": "mttr",
      "figure": "75 percent reduction in mean time to respond",
      "sample": "not published",
      "who_measured": "vendor (Business Value Assessments with individual Falcon Complete customers)",
      "date": "not stated",
      "source": "https://www.crowdstrike.com/en-us/services/falcon-complete-mdr/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "Footnote 4 attributes the figure to CrowdStrike Business Value Assessments conducted with individual customers. The footnote gives no customer count or baseline, and the figure belongs to a managed service rather than a platform."
    },
    {
      "subject": "eSentire MDR",
      "kind": "service",
      "platform_slug": null,
      "metric": "mttc",
      "figure": "Mean time to contain of less than 15 minutes",
      "sample": "not published",
      "who_measured": "vendor",
      "date": "not stated",
      "source": "https://www.esentire.com/what-we-do/esentire-managed-detection-and-response/response-and-remediation",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "Page text reads 'Mean Time to Contain of less than 15 minutes' and, in the FAQ, '15 Mean Time to Contain (MTTC)'. The page gives no sample or period, and the figure belongs to a managed service rather than a platform."
    },
    {
      "subject": "ReliaQuest GreyMatter (Veralto customer story)",
      "kind": "service_and_platform",
      "platform_slug": null,
      "metric": "mttc",
      "figure": "Mean time to contain reduced from weeks to under 1 minute",
      "sample": "one customer (Veralto), period not stated",
      "who_measured": "vendor-published customer story with customer quote",
      "date": "2026-03",
      "source": "https://reliaquest.com/customer-story/veralto-achieved-under-one-minute-mean-time-to-contain-with-greymatter-agentic-ai/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "Story says 94 percent of alert noise eliminated and 154 automated threat hunts in one quarter. Baseline described as 'weeks', with no method for how containment time was measured. ReliaQuest sells a platform and managed service; treated here as a comparison anchor."
    },
    {
      "subject": "ReliaQuest GreyMatter (metrics page)",
      "kind": "service_and_platform",
      "platform_slug": null,
      "metric": "mttc",
      "figure": "'Mean Time to Contain' tile on the SecOps metrics page, value is an animated counter and was not readable",
      "sample": "unknown",
      "who_measured": "vendor",
      "date": "not stated",
      "source": "https://reliaquest.com/solutions/secops-metrics-and-maturity/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "D",
      "notes": "The number could not be read from the page text, so it is not reported. Listed so the next refresh can capture it."
    },
    {
      "subject": "Expel MDR",
      "kind": "service",
      "platform_slug": null,
      "metric": "mttr",
      "figure": "14-minute mean time to remediate; page FAQ says 'under 15 minutes'",
      "sample": "not published",
      "who_measured": "vendor",
      "date": "not stated",
      "source": "https://expel.com/managed-detection-and-response/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "The metric is time to remediate rather than time to contain. Another Expel customer line on the homepage gives a 64 percent MTTR improvement. The page gives no sample, and the figure belongs to a managed service rather than a platform."
    },
    {
      "subject": "D3 Security Morpheus",
      "kind": "platform",
      "platform_slug": "d3-security",
      "metric": "mttc",
      "figure": "Containment time of 4 to 8 minutes once the response plan is approved",
      "sample": "not published",
      "who_measured": "vendor",
      "date": "not stated",
      "source": "https://d3security.com/morpheus/remediation/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "Same page states a 62-minute 'median dwell time' as the industry average between confirmed compromise and containment without a source. The 4 to 8 minute figure excludes analyst review time before approval."
    },
    {
      "subject": "D3 Security Morpheus",
      "kind": "platform",
      "platform_slug": "d3-security",
      "metric": "other",
      "figure": "Up to 95 percent of alerts triaged and L2-investigated in under two minutes",
      "sample": "not published",
      "who_measured": "vendor",
      "date": "not stated",
      "source": "https://d3security.com/morpheus/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "The figure measures triage speed rather than containment, and is included because the same product page frames time to contain as the metric that matters."
    },
    {
      "subject": "Swimlane Turbine with Hero AI",
      "kind": "platform",
      "platform_slug": "swimlane",
      "metric": "mttr",
      "figure": "MTTR down to 6.7 minutes with Hero AI",
      "sample": "Swimlane's own SOC, sample and period not stated on the listing page",
      "who_measured": "vendor (internal use)",
      "date": "not stated on listing page",
      "source": "https://swimlane.com/resources/case-studies/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "Case study title on the Swimlane case studies index. Full study not read. Home page separately claims Hero AI 'can help you reduce MTTR by 75 percent'."
    },
    {
      "subject": "Swimlane Turbine (Thetabyte customer story)",
      "kind": "platform",
      "platform_slug": "swimlane",
      "metric": "mttc",
      "figure": "Sub-5 minute threat containment",
      "sample": "one customer (Thetabyte, Africa energy), details not read",
      "who_measured": "customer testimonial published by the vendor",
      "date": "not stated on listing page",
      "source": "https://swimlane.com/resources/case-studies/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "claim_type": "customer",
      "grade": "C",
      "notes": "Case study title on the index; the study itself was not read."
    },
    {
      "subject": "Torq AI SOC Platform",
      "kind": "platform",
      "platform_slug": "torq",
      "metric": "mttr",
      "figure": "Global pharma customer cuts MTTR by 92 percent",
      "sample": "one customer, details not read",
      "who_measured": "vendor-published customer story",
      "date": "not stated",
      "source": "https://torq.io/customers/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "Customer story titles on the customers page. The same page headlines '10X faster response times' and '95% Tier-1 cases auto-remediated' with no method."
    },
    {
      "subject": "Dropzone AI",
      "kind": "platform",
      "platform_slug": "dropzone-ai",
      "metric": "mttr",
      "figure": "5x faster response, Indiana Farm Bureau Insurance",
      "sample": "one customer, baseline not stated",
      "who_measured": "vendor",
      "date": "not stated",
      "source": "https://www.dropzone.ai/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "Home page customer tile. Also says verdicts 'in under 10 minutes' on the AI SOC analyst page. Neither is a containment time."
    },
    {
      "subject": "Prophet AI Watchtower",
      "kind": "service",
      "platform_slug": null,
      "metric": "other",
      "figure": "Validated escalations in under 30 minutes; expert engages within 30 minutes",
      "sample": "not published",
      "who_measured": "vendor",
      "date": "not stated",
      "source": "https://www.prophetsecurity.ai/",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "Describes escalation latency of a human review service rather than containment. Prophet blog 'mean time to contain' defines the metric but gives no Prophet figure."
    },
    {
      "subject": "Mate Security",
      "kind": "platform",
      "platform_slug": "mate-security",
      "metric": "mttr",
      "figure": "Merlin Entertainments reduced MTTR by 93 percent",
      "sample": "one customer, period and baseline not stated",
      "who_measured": "vendor",
      "date": "not stated",
      "source": "https://mate.security/llms.txt",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "Statement in Mate's llms.txt summary. The mate.security homepage carries a Merlin CISO quote about operational impact without the number."
    },
    {
      "subject": "Google SecOps",
      "kind": "platform",
      "platform_slug": "google-secops",
      "metric": "other",
      "figure": "Customer quote: time to detect and time to investigate reduced from 2 hours to about 15 to 30 minutes",
      "sample": "one customer (Apex FinTech Solutions), self-reported",
      "who_measured": "customer quote on vendor page",
      "date": "not stated",
      "source": "https://cloud.google.com/security/products/security-operations",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "The figure covers detection and investigation rather than containment. The same page says analysts can track MTTR in the product but gives no Google figure."
    },
    {
      "subject": "Microsoft Sentinel with Security Copilot",
      "kind": "platform",
      "platform_slug": "microsoft-sentinel",
      "metric": "mttr",
      "figure": "Reduces mean time to respond by about 30 percent",
      "sample": "not stated on page",
      "who_measured": "vendor",
      "date": "not stated",
      "source": "https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-sentinel",
      "read": "2026-11-04",
      "vendor_claim": true,
      "grade": "C",
      "notes": "Page footnote and a linked research page support the figure; the research page was not read, so the method is unverified. The grade would rise only after that page is read."
    }
  ],
  "no_figure_found": [
    {
      "platform_slug": "palo-alto-cortex-xsoar",
      "pages_read": [
        "https://www.paloaltonetworks.com/cortex/cortex-xsoar"
      ],
      "result": "Page says it reduces investigation time from hours to minutes; no containment figure."
    },
    {
      "platform_slug": "splunk-soar",
      "pages_read": [
        "https://www.splunk.com/en_us/products/splunk-security-orchestration-and-automation.html"
      ],
      "result": "The page was not available on the read date (HTTP 404)."
    },
    {
      "platform_slug": "tines",
      "pages_read": [
        "https://www.tines.com/",
        "https://www.tines.com/customers/"
      ],
      "result": "No time-to-contain or MTTR figure on the pages read."
    },
    {
      "platform_slug": "servicenow-secops",
      "pages_read": [
        "https://www.servicenow.com/products/security-incident-response.html"
      ],
      "result": "The page refused automated access (HTTP 403), so it was not read."
    },
    {
      "platform_slug": "blink-ops",
      "pages_read": [
        "https://www.blinkops.com/",
        "https://www.blinkops.com/customers"
      ],
      "result": "The page refused automated access (HTTP 403), so it was not read."
    },
    {
      "platform_slug": "cyware",
      "pages_read": [
        "https://www.cyware.com/products/cyware-orchestrate"
      ],
      "result": "Page speaks of workflows built in minutes; no containment figure."
    },
    {
      "platform_slug": "threatconnect",
      "pages_read": [
        "https://threatconnect.com/"
      ],
      "result": "No containment figure on the page read."
    },
    {
      "platform_slug": "exabeam",
      "pages_read": [
        "https://www.exabeam.com/"
      ],
      "result": "No containment figure on the page read."
    },
    {
      "platform_slug": "revelstoke-arctic-wolf",
      "pages_read": [
        "https://arcticwolf.com/solutions/incident-response/"
      ],
      "result": "No containment figure on the page read."
    },
    {
      "platform_slug": "crowdstrike-falcon-fusion",
      "pages_read": [
        "https://www.crowdstrike.com/en-us/blog/how-to-scale-soc-automation-with-falcon-fusion-soar/"
      ],
      "result": "No Fusion-specific containment figure. The Falcon Complete MDR figure is listed as a service."
    }
  ]
}