Containment time is the period between detecting a security incident and fully isolating it so it can no longer spread. It measures how quickly defenders can cut off compromised accounts, hosts, network paths, or cloud services after an intrusion is discovered.
This metric matters because the longer an attacker stays active, the more damage they can do: deploy ransomware, steal data, move laterally, or abuse trusted third-party access. In practice, shorter containment time usually depends on clear incident response playbooks, fast identity revocation, network segmentation, endpoint isolation, and alert triage. In modern attacks, social engineering and remote access abuse can make containment harder because a valid login may look legitimate until additional checks are applied. Defensive automation and well-practiced response procedures help reduce containment time and limit the blast radius of a breach.