Skip to content
ENExplore Calculators

Containment Time Budget Calculator

Work out containment time budget instantly with clear inputs, formula shown and shareable results.

About Containment Time Budget Calculator

Containment time is detection plus triage plus execution, and attacker spread is that total multiplied by lateral movement rate. Detection almost always dominates, which is why investment in telemetry and automated triage buys more than faster manual containment. Published breakout times for hands-on-keyboard intrusions are measured in tens of minutes, which sets the bar.

Formula

Containment budget

total = MTTD + triage + containment execution; hosts reached = lateral movement rate x total / 60

Worked example

With the default values below, Containment Time Budget Calculator returns Total time to containment of 100.0. Change any input above and every figure here is recalculated in your browser.

Inputs used

Mean time to detectminimum 0.1 min
45 min
Triage and confirmation timeminimum 0 min
25 min
Time to execute containmentminimum 0 min
30 min
Attacker lateral movement rateminimum 0.01 hosts/h
6 hosts/h

Results

Total time to containment
100.0 min
Hosts an attacker could reach
10.0
Share of elapsed time spent detecting
45.0%
Assessment
Exceeds a one-hour containment goal - automate detection or response

Step by step

  1. 1Values used
  2. 2Containment budget
  3. 3Total time to containment= 100.0 min
  4. 4Hosts an attacker could reach= 10.0
  5. 5Share of elapsed time spent detecting= 45.0
  6. 6Assessment= Exceeds a one-hour containment goal - automate detection or response

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

What is breakout time?

The interval between initial compromise and the attacker moving laterally off the first host. Threat reports place the median well under an hour for skilled intrusion sets.

How is containment shortened most effectively?

Pre-authorised automated actions: isolate host, disable account, revoke tokens. Waiting for human approval on every action typically doubles the total.

Related Calculators

Containment Time Budget Calculator | Calcrivo