Mean time to contain
Mean time to contain is the average time to contain across a set of incidents. A mean hides the long tail, so a figure needs a sample size, a period, the clock definition and a note on who measured it. Without those, a mean time to contain is a slogan, not evidence.
Definition
Take two vendors that both report a mean of ten minutes. One measured fifty incidents in a quarter and the other measured three in a demo. The numbers are the same and the evidence is not.
A median and a worst case say more than a mean. Ask for the distribution, and ask whether incidents that needed a human approval are included or left out.
Mean time to contain in Swimlane's documentation
Swimlane's customers page quotes Thetabyte reporting threats contained in under 5 minutes and a 70 percent reduction in incident response time, and the page gives no period or method for either figure. customer claim swimlane.com, read
The example names a vendor and its own page. A vendor's use of Mean time to contain may differ from the definition above; the rubric uses the definition on this page.