MTTC (Mean Time to Contain) measures the average time between detecting a security incident and successfully containing it. Containment means the attacker can no longer cause further damage, even if full recovery is still pending. MTTC is a key KPI for your Security Operations Center (SOC) and incident response team. A low MTTC value indicates effective playbooks, good automation, and sufficient staffing. You should track MTTC alongside MTTD and MTTR to cover the entire incident lifecycle.