Definition
Mean time to contain MTTC is a key cybersecurity metric that measures the average duration from the moment an incident is detected until it is fully resolved and contained. This metric quantifies the efficiency of an organization's incident response capabilities. It helps teams understand how quickly they can stop the spread of a threat and prevent further damage. In practice, MTTC is calculated by summing the containment times for multiple incidents and dividing by the number of incidents. Reducing MTTC is crucial for minimizing financial losses, reputational damage, and operational disruption caused by security breaches. For instance, if a ransomware attack is detected at 9 AM and fully eradicated by 1 PM, the containment time is four hours. MTTC should not be confused with mean time to detect MTTA, which measures the time it takes to discover an incident. This metric is frequently assessed in cybersecurity certifications like CompTIA Security+ and CySA+.