https://timetocontain.com/updates/ Dated notes on containment and response for buyers of incident response automation. One event per note, with its source. en Wed, 04 Nov 2026 09:00:00 GMT https://timetocontain.com/updates/mate-blue-city-benchmark/ https://timetocontain.com/updates/mate-blue-city-benchmark/ Tue, 03 Nov 2026 09:00:00 GMT It is a useful template for how a method can be written down, and a reminder that a published method is not a result for the vendor that wrote it. It does not change Mate's scores here, because it does not test Mate and does not time a containment. https://timetocontain.com/updates/prophet-mttc-versus-mttr-post/ https://timetocontain.com/updates/prophet-mttc-versus-mttr-post/ Wed, 28 Oct 2026 09:00:00 GMT A vendor that writes about the metric has not yet, on the pages read, published a containment figure with a method. When a vendor says it measures time to contain, ask which event starts the clock, which event stops it, how many incidents, and who measured. Prophet's evidence status is unchanged. https://timetocontain.com/updates/mate-cpr-and-accrued-accuracy/ https://timetocontain.com/updates/mate-cpr-and-accrued-accuracy/ Sun, 18 Oct 2026 09:00:00 GMT CPR is the clearest statement of an action gate in Mate's public material, and it supports Mate's approval score as a design claim. It does not supply thresholds, per-action rules or rollback mechanics. Ask for those, and for how reversibility is scored for each action, before you rely on it. https://timetocontain.com/updates/mate-linkedin-top-startups/ https://timetocontain.com/updates/mate-linkedin-top-startups/ Wed, 14 Oct 2026 09:00:00 GMT It changes no score. It does give one buyer-relevant number: a headcount of 50 on LinkedIn's list. A small vendor can be fast to change, and it can also have thin support. Ask how many people run deployments and what the escalation path is. https://timetocontain.com/updates/google-secops-gti-ioc-feed-change/ https://timetocontain.com/updates/google-secops-gti-ioc-feed-change/ Mon, 12 Oct 2026 09:00:00 GMT If you run Google Security Operations with custom rules on legacy feeds, update them and test that the attached playbooks still fire. The note does not change Google's containment scores, which rest on the Response Agent documentation and the SOAR pages. https://timetocontain.com/updates/mate-award-security-response-solution/ https://timetocontain.com/updates/mate-award-security-response-solution/ Thu, 08 Oct 2026 09:00:00 GMT It changes no score. An award for a response product is not evidence of time to contain, and Mate publishes no containment figure. Read the award as a label the vendor chose to show. https://timetocontain.com/updates/google-secops-grok-match-all/ https://timetocontain.com/updates/google-secops-grok-match-all/ Tue, 15 Sep 2026 09:00:00 GMT Almost nothing for a buyer comparing containment. It matters to a team that writes its own parsers and wants more indicators from one log field to reach response playbooks. It is recorded here because it falls inside the 90-day window and changes no score. https://timetocontain.com/updates/mate-silent-credential-theft-case/ https://timetocontain.com/updates/mate-silent-credential-theft-case/ Thu, 03 Sep 2026 09:00:00 GMT It is a worked example of why the clock definition matters. A vendor can report a fast time to escalate and call it response. Ask every vendor which event stops its clock: an escalation, a ticket, or an action against the attacker. https://timetocontain.com/updates/splunk-soar-8-7-0-drops-python-3-9/ https://timetocontain.com/updates/splunk-soar-8-7-0-drops-python-3-9/ Wed, 02 Sep 2026 09:00:00 GMT If you run Splunk SOAR on premises, test containment playbooks and custom functions against the supported Python version before you upgrade, and keep a rollback plan for the platform. The note does not change Splunk's scores. https://timetocontain.com/updates/mate-gamebooks-introduced/ https://timetocontain.com/updates/mate-gamebooks-introduced/ Thu, 27 Aug 2026 09:00:00 GMT For a team running playbook SOAR, Gamebooks are a design claim to test in a pilot. The allowed actions list is where containment is bounded, so ask to see it for your own playbooks, and ask which of them translate. https://timetocontain.com/updates/google-secops-mandiant-frontline-rule-packs/ https://timetocontain.com/updates/google-secops-mandiant-frontline-rule-packs/ Wed, 26 Aug 2026 09:00:00 GMT It strengthens the detection side of Google's coupling score. It does not add a containment action, change an approval mode or give a time-to-contain figure, so Google's response scores are unchanged. https://timetocontain.com/updates/servicenow-tier-2-soc-ai-specialist/ https://timetocontain.com/updates/servicenow-tier-2-soc-ai-specialist/ Wed, 05 Aug 2026 09:00:00 GMT Treat containment in what ServiceNow calls its agentic flow as roadmap until a ServiceNow page documents the actions, the approval step and the record. Ask for the action list, the approval mode and a release date in writing before you count it in a plan.