Topic starter
02/08/2026 11:44 am
TL;DR: Mean time to contain measures how quickly a SOC stops a detected threat from spreading, and Torq argues that slow triage, manual workflows, and fragmented tooling are the main causes of delay. For IAM and security teams, MTTC is where containment decisions like revoking sessions or isolating access become operationally decisive, not theoretical.
Editorial analysis by NHI Mgmt Group, based on content published by torq: “How Torq Reduces Mean Time to Contain”.
Key questions
Q: What breaks when mean time to contain is too slow?
A: When MTTC is too slow, the SOC detects an incident before it can stop spread, so blast radius grows, more systems are exposed, and response teams inherit a larger recovery problem.
Q: Why does faster containment matter more for active incidents than detection alone?
A: Detection tells you something is wrong, but containment determines whether the threat keeps moving.
Q: What do security teams get wrong about containment during incidents?
A: They assume containment can be improvised quickly under pressure.
Practitioner guidance
- Automate Tier 1 containment triggers Wire common detections to deterministic actions such as host isolation, session revocation, and ticket creation so analysts are not manually starting every response path.
- Standardise containment playbooks by incident type Document the exact response sequence for phishing, credential compromise, malware execution, and suspicious login events so each analyst follows the same containment path.
- Remove handoffs between SOC tools Connect SIEM, EDR, identity providers, and ticketing into one orchestrated workflow so a containment decision executes across the stack without context switching.
Bottom line: Mean time to contain shows whether the SOC can stop a threat after detection or only observe it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:55 pm
MTTC is the control outcome that exposes whether a SOC can actually contain a live threat. Detection coverage alone does not tell you whether an organisation can stop spread once compromise is confirmed. The decisive question is whether containment actions can be executed before the attacker expands access, moves laterally, or extracts value. For identity-led environments, that makes session revocation, account blocking, and tool orchestration part of incident control, not just admin tasks.
A question worth separating out:
Q: How should SOC and IAM teams split responsibility for identity threat response?
A: SOC teams should own detection, triage, and containment decisions, while IAM teams should provide the identity context and control paths that make those actions possible. The two functions need shared telemetry and approved response actions. If they are separated, the organisation loses time at the exact point when identity abuse is moving fastest.
👉 Read our full editorial: Mean time to contain is the SOC metric that limits blast radius