Which KPI metric does SOAR use to measure the average time that it takes to stop and remediate a security incident?

Which KPI metric does SOAR use to measure the average time that it takes to stop and remediate a security incident?

• A. Mean Time To Detect
• B. Mean Time To Contain
• C. Mean Time To Control
• D. Mean Time To Remediate

Answer: (C)

Focuses on the moment the incident is brought under control. Mean Time To Control measures the average time from detection to when the incident is under control, meaning containment has halted the spread and remediation actions are underway or completed. This combines stopping the incident with moving into remediation, which is why it best fits the idea of “stop and remediate.” Other metrics look at detection alone, containment alone, or remediation alone, which don’t capture the full sequence. So the time to bring the incident under control is the most representative single KPI for this goal.

Focuses on the moment the incident is brought under control. Mean Time To Control measures the average time from detection to when the incident is under control, meaning containment has halted the spread and remediation actions are underway or completed. This combines stopping the incident with moving into remediation, which is why it best fits the idea of “stop and remediate.” Other metrics look at detection alone, containment alone, or remediation alone, which don’t capture the full sequence. So the time to bring the incident under control is the most representative single KPI for this goal.