Time to kill is the elapsed time between first detection of a threat and the point at which the threat is stopped or rendered inactive. Security teams use it to measure how quickly containment actions, such as isolation, blocking, or process termination, neutralise an attack path.
What Time To Kill Measures
Time to kill is a response-speed metric, not a vulnerability type. It tells you how long an adversary, malicious process, or active compromise remained effective before containment stopped the attack path.
Why Time To Kill Matters
As a measure, time to kill captures how quickly defenders can convert detection into interruption. Shorter times usually mean less opportunity for lateral movement, data access, process spawning, or repeated abuse, while longer times suggest the attack was able to operate with more freedom.
Because the metric spans the full interval from first detection to neutralisation, it reflects both operational alerting and the quality of the response path. A team may spot suspicious activity quickly but still record a poor result if escalation, decision-making, or containment is slow.
How Teams Use It Operationally
Security teams use time to kill to compare containment performance across incidents, tools, and environments. It is most useful when paired with related measures such as time to detect and time to contain, since those values help show where delay was introduced.
The metric also helps separate visibility problems from response problems. If detection is fast but time to kill is still high, the bottleneck is usually execution, authority, or process coordination rather than sensing.
What Time To Kill Reveals About Control Effectiveness
Time to kill is most informative when mapped to the actual containment action taken, such as isolating a host, disabling a session, blocking a domain, or terminating a process. That context shows whether the organisation stopped the threat at the right layer or merely reduced its speed.
It is also a useful way to judge whether playbooks and automation are doing real work. When the metric improves after new controls are introduced, the change can indicate better alert fidelity, faster triage, or more decisive containment authority.
Risk and Threat Considerations
Long time to kill increases the window in which an adversary can harvest credentials, move laterally, exfiltrate data, or establish persistence. It can also reveal that containment depends on too many manual steps or approvals, which gives the attacker more time than the defender has.
Failure mechanism: A threat is detected but not neutralised quickly enough, so the attacker continues to operate while defenders work through triage, handoffs, or incomplete containment actions.
Impact: The longer the threat remains active, the greater the chance of broader compromise, repeated abuse, service disruption, or recovery work that should have been avoided.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Time to kill often measures how long valid access stays usable after detection. |
| Recommendation — Hunt for account misuse and revoke compromised access as soon as containment begins. | ||
| NIST CSF 2.0 | RS.MA-1 — Incident Mitigation is Performed | The metric evaluates how effectively mitigation actions stop an active incident. |
| RS.AN-1 — Notifications from Detection Processes are Investigated | Detection-to-response delay is central to the elapsed time this metric captures. | |
| Recommendation — Measure containment speed and reduce the time between detection and mitigation. Investigate alerts quickly enough that response can begin before the threat expands. | ||
| NIST SP 800-53 Rev 5 | IR-4 — Incident Handling | Incident handling governs the actions that determine how quickly a threat is stopped. |
| Recommendation — Use incident handling procedures that enable rapid containment and eradication. | ||
Practitioner Guidance
Why practitioners should care: Time to kill is most useful when it is tied to a concrete containment decision, because that exposes whether the organisation can actually stop an active threat, not just observe it.
What to watch for: A consistently high value often means the weak point is somewhere between alerting and action, especially where response authority, isolation steps, or cross-team coordination are slow.
Practitioner takeaway: Treat this metric as a measure of containment speed, not just incident handling maturity, and review it alongside the exact control used to end the threat.