Work out containment time budget instantly with clear inputs, formula shown and shareable results.
Containment time is detection plus triage plus execution, and attacker spread is that total multiplied by lateral movement rate. Detection almost always dominates, which is why investment in telemetry and automated triage buys more than faster manual containment. Published breakout times for hands-on-keyboard intrusions are measured in tens of minutes, which sets the bar.
Containment budget
total = MTTD + triage + containment execution; hosts reached = lateral movement rate x total / 60
The interval between initial compromise and the attacker moving laterally off the first host. Threat reports place the median well under an hour for skilled intrusion sets.
Pre-authorised automated actions: isolate host, disable account, revoke tokens. Waiting for human approval on every action typically doubles the total.