Glossary: Incident Response and Resilience

time to detect

Also written: time to contain

Report measures taken from the timeline. Time to detect runs from the first attacker activity to its discovery (3 days for Jo), and time to contain runs from discovery to containment (50 minutes).