Mean Time to Contain (MTTC).

MTTC measures how long it takes to neutralize the active phase of an incident — isolating compromised hosts, disabling abused accounts, blocking malicious infrastructure, or revoking tokens. It is a critical metric because containment defines the point at which attacker progress is halted, even if eradication and recovery still lie ahead. MTTC depends on detection fidelity, the depth of SOAR playbooks, identity and network response capabilities, and decision authority during incidents. Mature programs measure MTTC by incident category and use it to justify investment in EDR isolation, zero-trust segmentation, identity threat detection and out-of-hours response coverage.