Mean Time to Contain (MTTC)
Average time from initial detection of a security incident to full containment — preventing further attacker progression or data exfiltration
Industry Benchmark
4.1 hours
-18.0% from previous period
Industry average: 6.8 hours
Calculation Method
MTTC = Average(Containment Timestamp − Detection Timestamp) across all confirmed incidents in the measurement period. Containment = all attacker-controlled assets isolated, no ongoing exfiltration or lateral movement
Significance
MTTC is the missing metric between MTTD and MTTR. Fast containment is what limits breach scope — it determines whether an incident affects one system or your entire environment.
What is Mean Time to Contain?
Mean Time to Contain (MTTC) measures the speed of active threat containment after detection. While MTTD measures detection speed and MTTR measures full recovery time, MTTC captures the critical window during which an attacker can still achieve their objectives. Every minute of uncontrolled attacker dwell time after detection increases potential blast radius, data exfiltration, and ransomware deployment scope.
The IR time metrics relationship
- MTTD (11.8h) — Time from incident occurrence to detection
- MTTC (4.1h) — Time from detection to containment (attacker stopped)
- MTTR (7.9h) — Time from detection to full recovery (systems restored)
- Total incident duration = MTTD + MTTR. MTTC sits inside MTTR and is the scope-limiting control.
Why it matters in 2026
Ransomware speed: Modern ransomware operators begin encryption within 45 minutes of initial access on compromised hosts. Containment within 1 hour prevents most encryption scenarios.
SEC materiality threshold: Breach scope — and thus materiality determination — is directly tied to how many systems were compromised before containment. Faster MTTC = smaller disclosure obligations.
Cost correlation: IBM CODB 2025: organizations containing breaches in under 200 days saved an average $1.12M versus those taking longer — containment speed is the single biggest cost lever.
Industry benchmarks by sector (2026)
- Financial Services: 2.9 hours average
- Technology: 3.4 hours average
- Healthcare: 8.2 hours average
- Retail: 7.1 hours average
- Manufacturing: 9.6 hours average