Benchmark Methodology
The 2025 Incident Response Benchmark is based on data from 312 confirmed security incidents handled by Paxanimi across client environments, supplemented by disclosed public incident data. We measure four dimensions: mean time to detect (MTTD), mean time to contain (MTTC), mean time to recover (MTTR), and total incident cost. We stratify results by organization size, industry, and SOC maturity level to enable meaningful peer comparison.
Detection: The Widening Gap
The median MTTD in our dataset is 23 days — but this figure masks a bimodal distribution. Organizations with 24/7 SOC coverage and behavioral analytics detect incidents in a median of 4 hours. Organizations relying on perimeter controls and log reviews detect incidents in a median of 47 days. The gap between best and worst practice has widened, not narrowed, over the past three years. The implication: the decision to invest in continuous monitoring is increasingly binary in its outcomes.
Containment and Recovery Benchmarks
Median MTTC for organizations with documented incident response playbooks is 6 hours. Without documented playbooks, MTTC is 3.2 days — a 12× difference. Median MTTR ranges from 4 days (mature IR capability) to 23 days (reactive organizations). Total incident cost follows a power law distribution: the top 20% of incidents by cost account for 73% of total losses. Ransomware continues to dominate the high-cost tail, with median ransom payment plus recovery cost reaching $4.2M for mid-market organizations in our dataset.
What Separates the Best Responders
Three practices consistently appear in organizations with the best IR benchmarks: pre-authorized response playbooks that do not require executive approval for initial containment actions; a tested and maintained asset inventory that enables rapid blast radius assessment; and a retainer relationship with external IR capability that can be activated within hours. Organizations that rehearse their IR playbooks through tabletop exercises quarterly show 40% better MTTC versus those that do not. The most expensive time to learn your incident response plan does not work is during an actual incident.