Notifications
Clear all
Topic starter
02/08/2026 11:44 am
TL;DR: Mean time to contain measures how quickly a SOC stops a detected threat from spreading, and Torq argues that slow triage, manual workflows, and fragmented tooling are the main causes of delay. For IAM and security teams, MTTC is where containment decisions like revoking sessions or isolating access become operationally decisive, not theoretical.
NHIMG editorial — based on content published by torq: Mean Time to Contain (MTTC) and why it matters for SOCs
Questions worth separating out
Q: How should security teams reduce mean time to contain in practice?
A: Start by automating the repeatable parts of triage and containment, then reserve human review for exceptions.
Q: Why does mean time to contain matter more when identities are compromised?
A: Because compromised identities often let attackers move faster than teams can manually coordinate response.
Q: What breaks when containment still depends on manual analyst action?
A: Response becomes inconsistent, slower, and harder to audit.
Practitioner guidance
- Measure containment separately from resolution Track detection time, containment time, and remediation time as distinct metrics so you can see whether the delay is in triage, access revocation, or recovery.
- Automate identity-based containment actions Prebuild workflow steps that can revoke sessions, disable users, quarantine privileged accounts, and terminate suspicious tokens without waiting for manual approval.
- Standardise high-frequency containment playbooks Document and automate the most common response paths, including credential compromise, malicious IP blocking, endpoint isolation, and cloud account lockdown.
What's in the full article
Torq's full article covers the operational detail this post intentionally leaves for the source:
- A full breakdown of how Torq maps MTTC to triage, investigation, and containment workflows across the SOC stack.
- Specific examples of automated response actions such as isolating hosts, revoking sessions, and updating case records in parallel.
- The platform's stated workflow claims, including Auto Triage, Socrates, Hyperautomation, and HyperAgents, with their operational context.
- The article's discussion of how Torq positions MTTC alongside MTTR, MTTA, and MTTD for SOC benchmarking.
👉 Read torq's analysis of mean time to contain and SOC automation →
Mean time to contain and SOC automation: are your controls keeping up?
Explore further
02/08/2026 12:55 pm
MTTC is increasingly the better indicator of operational maturity than detection speed alone. Detection can be strong while containment remains weak, especially where teams still rely on manual approval chains and ad hoc analyst judgement. That gap means the organisation knows a threat exists but cannot stop it quickly enough. For identity programmes, the same pattern appears when revocation and session termination are slow to execute. Practitioner conclusion: measure whether containment is automated at the same level as detection.
A question worth separating out:
Q: What should teams do when they detect an active compromise before containment is complete?
A: Prioritise actions that shrink blast radius first. That usually means revoking access, isolating affected systems, and cutting off repeatable paths of movement before moving to deeper investigation. The goal is to stop spread before root-cause work begins, because containment is the control that protects the rest of the environment.
👉 Read our full editorial: Mean time to contain is the SOC metric that limits blast radius
