Time-to-contain evidence register
Every containment or response-time figure found on the pages read, with sample, who measured it, date and grade. Read 2026-11-04. 16 figures: 15 grade C, 1 grade D.
15 of 16are grade C
What the register shows
No figure on any page read reaches grade B or A. Fifteen of sixteen items are grade C and one is grade D. The metrics are not comparable: they mix mean and median, contain and remediate, one customer and unstated samples.
Items with kind 'service' are managed detection and response services. They are comparison anchors, not platforms, and are never ranked against the platforms. Managed detection and response services are shown in their own table, as comparison anchors. A service sells analysts and a response team on top of software, so its number is not a platform's number.
A to D
How figures are graded
- Grade A
- Independent measurement with method published.
- Grade B
- Vendor-measured, with sample and method published.
- Grade C
- Vendor number without method.
- Grade D
- Unverifiable, unreadable or contradicted.
The rubric caps a criterion at partial for any outcome number without a published method. See the guide on reading a vendor's response-time number.
9figures
Figures published by platforms
| Platform | Metric | Figure | Sample, who measured, date | Grade | Source |
|---|---|---|---|---|---|
| D3 Security Morpheus | time to contain | Containment time of 4 to 8 minutes once the response plan is approved | not published. Measured by vendor. Date: not stated. Same page states a 62-minute 'median dwell time' as the industry average between confirmed compromise and containment without a source. The 4 to 8 minute figure excludes analyst review time before approval. | C | vendor claim d3security.com, read |
| D3 Security Morpheus | adjacent measure | Up to 95 percent of alerts triaged and L2-investigated in under two minutes | not published. Measured by vendor. Date: not stated. The figure measures triage speed rather than containment, and is included because the same product page frames time to contain as the metric that matters. | C | vendor claim d3security.com, read |
| Swimlane Turbine with Hero AI | time to respond or remediate | MTTR down to 6.7 minutes with Hero AI | Swimlane's own SOC, sample and period not stated on the listing page. Measured by vendor (internal use). Date: not stated on listing page. Case study title on the Swimlane case studies index. Full study not read. Home page separately claims Hero AI 'can help you reduce MTTR by 75 percent'. | C | vendor claim swimlane.com, read |
| Swimlane Turbine (Thetabyte customer story) | time to contain | Sub-5 minute threat containment | one customer (Thetabyte, Africa energy), details not read. Measured by customer testimonial published by the vendor. Date: not stated on listing page. Case study title on the index; the study itself was not read. | C | customer claim swimlane.com, read |
| Torq AI SOC Platform | time to respond or remediate | Global pharma customer cuts MTTR by 92 percent | one customer, details not read. Measured by vendor-published customer story. Date: not stated. Customer story titles on the customers page. The same page headlines '10X faster response times' and '95% Tier-1 cases auto-remediated' with no method. | C | vendor claim torq.io, read |
| Dropzone AI | time to respond or remediate | 5x faster response, Indiana Farm Bureau Insurance | one customer, baseline not stated. Measured by vendor. Date: not stated. Home page customer tile. Also says verdicts 'in under 10 minutes' on the AI SOC analyst page. Neither is a containment time. | C | vendor claim dropzone.ai, read |
| Mate Security | time to respond or remediate | Merlin Entertainments reduced MTTR by 93 percent | one customer, period and baseline not stated. Measured by vendor. Date: not stated. Statement in Mate's llms.txt summary. The mate.security homepage carries a Merlin CISO quote about operational impact without the number. | C | vendor claim mate.security, read |
| Google SecOps | adjacent measure | Customer quote: time to detect and time to investigate reduced from 2 hours to about 15 to 30 minutes | one customer (Apex FinTech Solutions), self-reported. Measured by customer quote on vendor page. Date: not stated. The figure covers detection and investigation rather than containment. The same page says analysts can track MTTR in the product but gives no Google figure. | C | vendor claim cloud.google.com, read |
| Microsoft Sentinel with Security Copilot | time to respond or remediate | Reduces mean time to respond by about 30 percent | not stated on page. Measured by vendor. Date: not stated. Page footnote and a linked research page support the figure; the research page was not read in this pass, so method is unverified here. Promote to B or A only after reading it. | C | vendor claim microsoft.com, read |
7service figures
Managed services, shown as services
These are managed detection and response offerings and service-led vendors. They are anchors for what a service claims. They are not ranked against the platforms and they do not enter any score.
| Subject | What it is | Metric | Figure | Sample, who measured, date | Grade | Source |
|---|---|---|---|---|---|---|
| CrowdStrike Falcon Complete | managed service | time to contain | 1 minute, median time to contain | not published. Measured by vendor. Date: not stated on page; page references the 2026 Global Threat Report and 2026 content. Footnote defines MTTC as the time from initial detection to successful containment controls on an endpoint, covering automation, platform enforcement and expert operations, and says results vary with offline hosts. The footnote gives no sample size, period or customer count, and the figure belongs to a managed service rather than a platform. | C | vendor claim crowdstrike.com, read |
| CrowdStrike Falcon Complete | managed service | time to respond or remediate | 75 percent reduction in mean time to respond | not published. Measured by vendor (Business Value Assessments with individual Falcon Complete customers). Date: not stated. Footnote 4 attributes the figure to CrowdStrike Business Value Assessments conducted with individual customers. The footnote gives no customer count or baseline, and the figure belongs to a managed service rather than a platform. | C | vendor claim crowdstrike.com, read |
| eSentire MDR | managed service | time to contain | Mean time to contain of less than 15 minutes | not published. Measured by vendor. Date: not stated. Page text reads 'Mean Time to Contain of less than 15 minutes' and, in the FAQ, '15 Mean Time to Contain (MTTC)'. The page gives no sample or period, and the figure belongs to a managed service rather than a platform. | C | vendor claim esentire.com, read |
| ReliaQuest GreyMatter (Veralto customer story) | platform and managed service | time to contain | Mean time to contain reduced from weeks to under 1 minute | one customer (Veralto), period not stated. Measured by vendor-published customer story with customer quote. Date: 2026-03. Story says 94 percent of alert noise eliminated and 154 automated threat hunts in one quarter. Baseline described as 'weeks', with no method for how containment time was measured. ReliaQuest sells a platform and managed service; treated here as a comparison anchor. | C | vendor claim reliaquest.com, read |
| ReliaQuest GreyMatter (metrics page) | platform and managed service | time to contain | 'Mean Time to Contain' tile on the SecOps metrics page, value is an animated counter and was not readable | unknown. Measured by vendor. Date: not stated. The number could not be read from the page text, so it is not reported. Listed so the next refresh can capture it. | D | vendor claim reliaquest.com, read |
| Expel MDR | managed service | time to respond or remediate | 14-minute mean time to remediate; page FAQ says 'under 15 minutes' | not published. Measured by vendor. Date: not stated. The metric is time to remediate rather than time to contain. Another Expel customer line on the homepage gives a 64 percent MTTR improvement. The page gives no sample, and the figure belongs to a managed service rather than a platform. | C | vendor claim expel.com, read |
| Prophet AI Watchtower | managed service | adjacent measure | Validated escalations in under 30 minutes; expert engages within 30 minutes | not published. Measured by vendor. Date: not stated. Describes escalation latency of a human review service rather than containment. Prophet blog 'mean time to contain' defines the metric but gives no Prophet figure. | C | vendor claim prophetsecurity.ai, read |
10searched, nothing found
Platforms with no figure found
For these platforms the pages read carried no containment figure. Unreadable pages are recorded as such and scored as not documented.
- Palo Alto Cortex XSOAR: Page says it reduces investigation time from hours to minutes; no containment figure. paloaltonetworks.com, read
- Splunk SOAR (Cisco): Page returned 404 on the read date. splunk.com, read
- Tines: No time-to-contain or MTTR figure on the pages read. tines.com, read tines.com, read
- ServiceNow Security Operations: Returned 403 to a plain fetch. servicenow.com, read
- BlinkOps: Returned 403 to a plain fetch. blinkops.com, read blinkops.com, read
- Cyware: Page speaks of workflows built in minutes; no containment figure. cyware.com, read
- ThreatConnect: No containment figure on the page read. threatconnect.com, read
- Exabeam: No containment figure on the page read. exabeam.com, read
- Revelstoke (Arctic Wolf): No containment figure on the page read. arcticwolf.com, read
- CrowdStrike Falcon Fusion SOAR: No Fusion-specific containment figure. The Falcon Complete MDR figure is listed as a service. crowdstrike.com, read
The figures are free to download as CSV and JSON.