Mean Time to Contain
Noun · Security & Infosec
Definitions
A response metric measuring how long it takes from detection or incident start to the point where the threat is effectively isolated or prevented from causing further spread. Mean time to contain is useful because fast detection without fast containment still leaves systems exposed.
In plain English: The average time it takes to stop an incident from spreading further.
Example: "Their mean time to contain improved after endpoint isolation was automated for high-confidence ransomware detections."