Compute security mean time to respond across detect, triage, contain, eradicate and recover phases, with automation savings.
Automation is applied unevenly on purpose: SOAR enrichment and auto-closure remove most of the triage minutes, but containment still needs approvals, change windows and a human decision to isolate a production host, so only about 60% of the automation share carries through. MTTR is the headline SOC metric in most board packs, and decomposing it stops the common trap of celebrating faster triage while containment — the phase that actually limits damage — stays measured in days.
Security MTTR
MTTR = detect + triage + contain + eradicate + recover, with triage reduced by the automation share and containment by 60% of it.
Mean time to contain
Mean time to contain = detect + triage + contain — the metric that tracks damage, since eradication and recovery happen after the bleeding stops.
MTTR = detect + triage + contain + eradicate + recover, with triage reduced by the automation share and containment by 60% of it. Automation is applied unevenly on purpose: SOAR enrichment and auto-closure remove most of the triage minutes, but containment still needs approvals, change windows and a human decision to isolate a production host, so only about 60% of the automation share carries through.
MTTR is the headline SOC metric in most board packs, and decomposing it stops the common trap of celebrating faster triage while containment — the phase that actually limits damage — stays measured in days.
This calculator takes 7 inputs: Detect phase, Triage and validate phase, Contain phase, Eradicate phase, Recover and verify phase, Triage and containment steps automated, Incidents of this class per year. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
MTTC drives risk; MTTR drives cost. Containment ends the attacker's access, so it bounds the damage, while eradication and recovery mostly consume engineering hours. Track both and never let a good MTTR hide a slow containment.
Yes, if that is what really happens. Excluding nights and weekends produces a flattering number that no longer describes your exposure. Measure wall-clock, then use the gap between wall-clock and working-hours MTTR as the business case for 24×7 coverage.