Time to contain starts when someone detects an intrusion and stops when the attacker can no longer act: the account is disabled, the token revoked, the host isolated. It sits after dwell time, which measures how long the attacker went unnoticed. Many security teams track detection carefully and containment loosely, because containment depends on hand-offs between the security team, IT operations and the business.
Those hand-offs are where the clock runs. An alert is triaged, escalated, approved and then acted on, and each step takes minutes or hours. When an attacker’s agents can move from a foothold to domain controller credentials in about 20 minutes, a containment process that takes a working day loses the race before it starts.
The practical fix is to pre-authorise a short list of reversible actions that systems may take on their own at a stated confidence, and have a person review them afterwards. Report time to contain to the board next to time to detect. An organisation that can only quote the second number does not yet know how fast it can stop an attack.