Mean Time to Identify and Contain a Breach
The average days from the start of a confirmed security breach to its identification, plus the days from identification to containment.
Formula
Mean of (identified date − start date) + Mean of (contained date − identified date)
Why Track It
Every day an attacker sits undetected raises the cost and the chance of losing the client. The trend shows whether detection tooling and monitoring are catching intrusions early.
How It Is Measured
For each confirmed security incident at a client or at the MSP, record when the compromise began (from forensic evidence), when it was identified and when it was contained. Report the two intervals separately and combined. Source: the incident response record or security tickets in the PSA, with dates confirmed by the investigation.
Constraints
Most small MSPs see few confirmed breaches, so the mean rests on a handful of events. The start date depends on forensic work that is often incomplete.
Measurement Note
IBM's 2025 Cost of a Data Breach Report found a mean of 241 days to identify and contain a breach, the lowest in nine years. That is a cross-industry mean, not an MSP benchmark, so an MSP running managed detection should sit well below it and track its own trend.
Referenced In
Related KPIs
- Backup Success RateThe share of scheduled backup jobs that completed successfully in the period.
- Patch Compliance RateThe share of managed endpoints with critical and high severity patches installed within the patch SLA.
- MFA CoverageThe share of client user accounts enforced to use multi-factor authentication, with admin accounts tracked separately.
- Restore Test Pass RateThe share of scheduled test restores or automated backup verifications that recovered data or systems successfully.
- Phish-Prone PercentageThe share of client users who click a link, open an attachment or enter credentials in a simulated phishing test.
Glossary and Answers
More in Security Operations
Whether the basic controls an MSP runs for clients are actually in place and working. These numbers show how exposed the client base is to the breach that ends a client relationship.
- Backup Success RateCentralized Services Lead
- MFA CoverageSecurity Lead
- Patch Compliance RateCentralized Services Lead
- Phish-Prone PercentageSecurity Lead
- Restore Test Pass RateCentralized Services Lead