Incident response stalls after an alert fires when the next step has no clear owner, or when containment has to wait for an approval. The detection did its job. The time goes to the handoffs between people and teams, and the most common response metrics stop measuring before those handoffs begin.
This page explains where that time goes and what to change so containment starts sooner.
Where the time goes
- Ownership. An alert type with no named owner waits while people work out whose move it is.
- Approvals. Containment that needs sign-off from outside the security team waits until that person answers.
- Handoffs. Each move between teams, or between a provider and your staff, adds time to explain context.
- Measurement. Time to detect and time to acknowledge stop before this gap, so it stays out of view.
Where does incident response slow down?
The pauses tend to appear at the same kinds of points. Each one looks small in the response plan, and each one adds minutes while an attacker keeps moving.
The next step has no owner
The alert reaches a queue, and the SOC and the identity team each assume someone else will act. Escalation then depends on memory and side conversations.
Containment waits for approval
Disabling an account or isolating a server may need a leader outside security to agree. If that person is in a meeting or asleep, the response waits with them.
Context is lost in a handoff
An alert moves from one team or provider to another, and the receiving team has to rebuild what the first team already knew before it can act.
The plan was never exercised
Roles are written down and nobody has practiced them together. People hesitate because the decision is unfamiliar, even though the plan covers it.
Our post The Alert Fired. The Team Froze. walks through how these pauses build on each other inside well-equipped security teams.
Why do the minutes after an alert matter?
29 min
The average eCrime breakout time in 2025, measured from initial access to the attacker moving to another system. The fastest observed breakout was 27 seconds. Source: CrowdStrike 2026 Global Threat Report.
Attackers also take data quickly. In one in five cases in the 2025 Unit 42 Global Incident Response Report, data theft happened in under an hour. Every minute spent working out who owns the next step is a minute the attacker keeps.
What is time to own?
We call the interval between an alert being seen and a named person taking the next step time to own. It sits between the metrics most teams already report, which is why a response can look fast on paper and still feel slow during an incident.
| Metric | Starts when | Stops when | What it shows |
|---|---|---|---|
| Time to detect | Malicious activity begins | An alert fires | Coverage and detection quality |
| Time to acknowledge | The alert fires | Someone opens it | Queue load and staffing |
| Time to own | The alert is seen | A named owner starts the next step | Delays from handoffs and approvals |
| Time to contain | The owner acts | The threat is stopped | Whether the response actions work |
Our post The Plan Was There But The Action Wasn’t explains why this delay rarely appears in documentation and how to find it.
How do you close the gap between alert and containment?
The fixes are mostly decisions made before an incident, so nobody has to make them under pressure.
- Name an owner for each alert type. Write down, by role, who takes the next step for each type of alert, and update the list when people change jobs.
- Match escalation paths to decision rights. Make sure the path reaches the person who can approve containment first, with a backup who can act when that person is unavailable.
- Agree on containment before the incident. Decide in advance which confirmed threats allow immediate action, such as isolating a device or blocking an account.
- Rehearse the handoffs. Follow a realistic alert from detection to containment in an exercise and record every point where someone waited.
Once containment is agreed, much of it can run automatically. For the operating models that make this work with a provider, read how co-managed Microsoft Sentinel works.
What changes when an MDR provider is involved?
A provider adds one more handoff, so the agreement on who may act matters even more. Ask whether the provider contains threats itself, which threat types it may act on without calling you first, and how it reports what it did.
In Accelerynt MDR, your team and ours agree before an incident on the specific threat types that authorize our team to act immediately inside your tenant. Every containment action is documented with what was found, how access was gained, what we did and what your team should review. The MDR stages page sets out what each side provides.
For what to compare between providers, read how to choose MDR for a Microsoft environment. For the metrics that show whether response is improving, read which SOC metrics show whether risk is going down.
Where should you start?
After your next incident or exercise, go back through the timeline and mark every point where someone waited, and for what. Those marks show where ownership or approval broke down, and they give you a baseline for time to own.
Accountability for that timeline stays with you even when a provider runs part of the response, which is the argument in our post You Can Outsource Operations, But Not Accountability. To see how Accelerynt works inside your environment with your team, read about the MDR engagement model.
For how to automate the containment step once it is agreed, read how to automate incident containment in Microsoft Sentinel.
Frequently asked questions
Why does incident response stall after the alert fires?
Response usually stalls in the handoffs after detection. The next step may have no clear owner, or containment may need an approval that is not ready yet.
What is time to own in incident response?
Time to own is the interval between an alert being seen and a named person taking the next step. It captures delays from unclear ownership and handoffs that time to detect and time to acknowledge do not measure.
Which MDR providers do the remediation for you instead of just alerting?
Look for a provider that agrees containment authority with you before an incident and acts inside your environment for the threat types you approve. Ask it to show how every action is documented. Accelerynt MDR works this way inside your Microsoft tenant, and its later stages also work with your team to address vulnerability backlogs and misconfigurations.
How do you reduce the time between an alert and containment?
Name an owner for each alert type, route escalation to the people who hold decision rights, agree in advance which threats allow immediate containment, and rehearse the handoffs in a realistic exercise.