Time to Contain

Questions on time to contain

30 questions in five groups. Every answer that names a vendor carries its page and read date.

6questions

Metric and scope

What is time to contain?
Time to contain is the time from the first detection signal on an incident to the first action that stops the attacker spreading or acting. That action may be a host isolation, a session revocation, an account disablement, a message pull, a key rotation or an address block. It is not the time to close a ticket and not the time to resolve. This site defines it the same way on every page. Vendors now write about it: Prophet Security lists a post on the metric dated 2026-10-28 (prophetsecurity.ai/blog, read 2026-11-03).
How is time to contain different from MTTR?
MTTR can mean mean time to respond, recover or resolve, and the vendor picks. Time to contain has a defined stop event, an action against the attacker. A response time that stops at a verdict or a ticket says little about the attacker. Swimlane's page links a resource titled MTTR down to 6.7 min with Hero AI, and the page describes no method for it (swimlane.com/swimlane-turbine, read 2026-11-03, vendor claim). Ask what stopped the clock.
Where does the clock start and stop?
It starts at the first detection signal, which can be an alert, a user report or an analyst finding, and it can predate the alert a tool shows. It stops at the first action that limits the attacker. Vendors rarely state either point. D3 Security claims containment in 4 to 8 minutes once the response plan is approved, a figure that leaves out analyst review time before approval (d3security.com/morpheus/remediation, read 2026-11-04, vendor claim).
Does this site cover PagerDuty and incident.io?
No. IT incident management tools route on-call alerts and run service incidents. They do not take containment actions against an attacker, and a buyer comparing them with a security response platform would compare two different jobs. This site covers security incident response automation platforms only. The fourteen covered platforms are listed on the home page, each scored on the same eight criteria and the same published rubric.
Does any vendor publish a time-to-contain figure with a method?
Not on the pages read on 2026-11-04. The evidence register grades sixteen published response-time figures: fifteen are grade C, one is grade D, and none reaches B. The closest to containment are D3's 4 to 8 minutes once a plan is approved and Swimlane's customer quote of under 5 minutes, D3's a vendor claim and Swimlane's a customer claim, a testimonial published by the vendor, both with no sample or period (d3security.com/morpheus/remediation and swimlane.com/resources/case-studies, read 2026-11-04).
How should I read a vendor's response-time number?
Ask five things: the start event, the stop event, the number of incidents, the period and who measured. Mate states a sample for its accuracy claim, 98.7 percent on 7,200 alerts, but not where the alerts came from or how they were labelled, and it is accuracy, not time (mate.security, read 2026-11-03, vendor claim). A figure with a sample and no method is better than a slogan and still partial.

6questions

Containment actions and coverage

Which containment actions does the scorecard count?
The scorecard checks 25 actions in five domains against each vendor's own documentation. EDR has six, among them isolate host, release isolation, kill process and block hash. Identity has five, including disable user, revoke sessions and MFA re-enrolment. Email has five, cloud has five including revoking OAuth consent, and network has four, including a block at the firewall or at the DNS filter. The action catalogue is version 2026-11-04.
What does native mean on the scorecard?
An action is native when the vendor's own documentation lists it as a shipped action for at least one named product in that domain. A generic HTTP request step, a custom script, a community pack the vendor does not list, or a statement that it integrates with a product does not count. CrowdStrike's Falcon Fusion and Agentic SOAR pages, for example, name no disable-user action (crowdstrike.com, read 2026-11-03).
Why does a generic HTTP step not count?
Any platform can call any API, so counting that would give every platform full coverage. A buyer who relies on it owns the build, the tests and the upkeep, and the vendor has documented no gate or scope for it. Splunk SOAR, for instance, lets users write custom functions in Python (help.splunk.com, read 2026-11-04), which is flexible and is also work you do and own.
Which containment action should I automate first?
Start narrow and reversible. This is the editor's view, not a vendor claim. Block a known-bad indicator at the firewall or DNS filter, quarantine a phishing message instead of deleting it, then revoke sessions, and add host isolation behind an approval. Google's Response Agent documentation takes the same cautious line by making manual approval the default (docs.cloud.google.com, read 2026-11-03).
Can I trust integration counts?
Treat them as marketing until you see the list. Counts use different units. Splunk SOAR states 2,800+ actions across 300+ tools, Palo Alto states 900+ packs, D3 Security states 800+ connectors and Cyware states 400+ integrations, all vendor claims read on 2026-11-03 and 2026-11-04. An integration with a product is not the same as the one action you need, so check the actions.
Do I need a SIEM in front of the response platform?
It depends on the platform. Microsoft Sentinel takes incidents inside the product, including those from Defender XDR (learn.microsoft.com, read 2026-11-03). Google holds the SIEM and the Response Agent in one product (docs.cloud.google.com, read 2026-11-03). Swimlane says customer detection alerts flow into the same routing as SIEM and EDR alerts (vendor claim). Prophet, Mate and D3 do not say whether a SIEM is required.

6questions

Approval and rollback

What approval modes do vendors document?
Three patterns appear. Google documents manual approval by default, thresholds at Low, Medium or High risk and per-action overrides, though the Response Agent is Pre-GA (docs.cloud.google.com, read 2026-11-03). D3 Security states approval gates at every command-risk tier, and Mate names Recommend only, Supervised and Auto-run, both vendor claims (d3security.com/platform and mate.security/platform, read 2026-11-03).
Is rollback documented for actions?
Mostly not. Cyware lists rollback of workflows to earlier versions, which does not undo an action already taken (cyware.com, read 2026-11-03). Google's Response Agent page and D3's platform page state approval controls and no rollback for actions. Test it in a pilot: isolate a host, release it, disable an account and re-enable it, then check what the record shows for each step.
What is blast radius and how do vendors limit it?
Blast radius is how much damage a wrong action can do. A documented limit might be a role scope, a count cap or an approval tier. Microsoft Sentinel says a rule needs the Microsoft Sentinel Automation Contributor role on the playbook's resource group to run it (learn.microsoft.com, read 2026-11-03). Most vendor pages read state no scope limit, so ask for the largest single action the platform can take.
Should containment run on its own?
Decide by reversibility, not by enthusiasm. This is the editor's view. Let narrow, reversible actions run alone once they have run in shadow mode, and keep approval on anything that cuts off many users. Prophet says its autonomous product takes only actions the customer has approved and previews remediation before it runs (prophetsecurity.ai/ai-soc-analyst, read 2026-11-03, vendor claim).
What is shadow mode and should I use it?
Shadow mode runs the platform on real alerts without letting it act, so you can compare its proposed actions with what your analysts did. Use it. Mate says it starts in shadow mode on real alerts (mate.security/platform, read 2026-11-03, vendor claim). Prophet offers a free proof of value with read-only access to two or three data sources (prophetsecurity.ai/ai-soc-analyst, read 2026-11-03). Write exit criteria before you start.
What happens when the automation is wrong?
Public pages say little. Mate says a category returns to Supervised when accuracy drifts (mate.security/platform, read 2026-11-03, vendor claim), which limits future actions and does not undo the one already taken. No vendor page read states how a wrong isolation or disablement is reversed and recorded. Ask for a demonstration of the reversal, with the record it leaves, before you sign.

6questions

Audit and regulators

What should a reviewer be able to read after an automated action?
At least the actor, the time, the evidence, the command and the outcome, plus where the record is kept and how long. D3 Security describes an audit record that is immutable, timestamped and attributed at the command level, covering playbook steps, analyst approvals, integration calls and outcomes (d3security.com/platform, read 2026-11-03, vendor claim). Ask each vendor for a sample record.
Which vendors publish what the audit record contains?
Few do. D3 Security describes its record in detail and Torq says every verdict, decision, exception and override is captured with the context of when and why, both vendor claims (d3security.com/platform and torq.io, read 2026-11-03). Google says read-only users can view execution history and output (docs.cloud.google.com, read 2026-11-03). Most other pages say audit trail without contents.
Can I export the record for a regulator?
D3 Security describes regulator-ready exports and does not publish the format, fields or retention (d3security.com/platform, read 2026-11-03, vendor claim). Google's Response Agent page states no export or retention for action records. Ask your own reviewer what they need, then test an export against it. A phrase on a product page is not a format.
Do regulators accept any vendor's records?
This site found no regulator statement accepting any vendor's records and makes no such claim. Mate's home page lists Lead Bank and OCBC with named CISO testimonials, which are vendor claims about SOC investigation. Neither mentions containment, response time or an audit trail format, and we found no statement from either bank (mate.security, read 2026-11-03). Ask your regulator directly.
Is a decision trace the same as an audit log?
No. An audit log records what was done. A decision trace records why: the evidence, the rule or model and any override. Mate's platform page says Decision Traces record why an analyst decided and that stored facts carry source, confidence and freshness, while log format, export and retention are not described (mate.security/platform, read 2026-11-03, vendor claim). A reviewer may want both.
How long are response records kept?
Retention for action records is not stated on most pages read. Google's product page says its Standard package includes 12 months of hot data retention for SIEM telemetry, which is not the same as retention of response actions, and says each package is priced through sales (cloud.google.com/security/products/security-operations, read 2026-11-04). Ask for a retention period in writing, and ask whether closing a case deletes the record.

6questions

Buying, pricing and deployment

Which vendors publish prices?
Microsoft Sentinel publishes prices with units, including pay-as-you-go and commitment tiers for the analytics tier, and playbooks add Logic Apps charges (microsoft.com, read 2026-11-03). Tines publishes a free edition with 3 live workflows (tines.com/pricing, read 2026-11-03). D3 Security describes its structure by alert-volume tier without amounts. Most others say contact sales, or their pricing page did not resolve.
What does Mate cost?
Mate publishes no price. The site has no pricing page, and every call to action is a demo or a request to talk to an expert. It is also available through an AWS Marketplace private offer, and no list price was read (mate.security/platform/replace-soar-with-ai, read 2026-11-03, vendor claim). This site scores that as not documented and does not estimate a cost.
Can I buy through a cloud marketplace?
Some vendors list there. Mate has been on AWS Marketplace since 2026-01-15, with private-offer spend counting toward AWS commitments (mate.security/blog, read 2026-11-03, vendor claim). Channel Insider reported on 2025-10-22 that Cyware solutions are in the Microsoft Commercial Marketplace. A marketplace route can ease procurement and drawdown. It does not publish a price.
Where does my data live?
It varies and is often unstated. D3 Security states Azure with residency in the United States, Canada, Ireland or Japan and an isolated on-premises option (d3security.com/platform, read 2026-11-03). Prophet states single-tenant deployment with a bring-your-own-key option and no training of AI models with personal data (prophetsecurity.ai, read 2026-11-03). Mate describes a SaaS offering and does not describe residency or retention.
How do I run a pilot?
Run it in shadow mode first, then with approval on, then with narrow actions alone, over 30 days with written exit criteria. Several vendors lower the entry cost: Prophet offers a free proof of value on read-only access, Tines publishes a free edition and CrowdStrike offers a 15-day trial (prophetsecurity.ai, tines.com and crowdstrike.com, read 2026-11-03). Test reversal and the audit record, not only speed.
Can I move off an existing SOAR?
Two vendors say so. D3 Security names Cortex XSOAR, Splunk SOAR, Swimlane, Torq and Tines in a free migration program (d3security.com/pricing, read 2026-11-03, vendor claim). Mate says it translates SOAR playbooks into Gamebooks and validates them, with no list of source products (mate.security/platform/gamebooks, read 2026-11-03, vendor claim). Palo Alto lists XSOAR 8.x on-premises end of life as 2029-09-30 (paloaltonetworks.com, read 2026-11-04).