Time to contain
Time to contain is the elapsed time from the first detection signal on an incident to the first action that stops the attacker spreading or acting. It is not the time to close a ticket or to resolve the incident. This site is built around it because containment is where automation saves most.
Definition
The clock starts at the first detection signal, which may be an alert, a user report or an analyst finding. It stops at the first action that limits the attacker: a host isolated, a session revoked, an account disabled, a message pulled, a key rotated or an address blocked.
Ask every vendor which event stops its clock. An escalation to a person, a closed alert and a ticket update are all things vendors call response. None of them contains an attacker.
Time to contain in Prophet Security's documentation
Prophet Security's blog lists a post dated 2026-10-28 titled Mean Time to Contain (MTTC) vs MTTR in an AI-Driven SOC, which shows vendors now write about the metric even where no figure with a method is published. vendor claim prophetsecurity.ai, read
The example names a vendor and its own page. A vendor's use of Time to contain may differ from the definition above; the rubric uses the definition on this page.