Industrial Cybersecurity & OT Risk worked example

Mean Time to Contain Cyber at 52% coordination and validation allowance: a worked example

Push coordination and validation allowance up to 52% and the picture changes. This example computes every intermediate figure at that operating point. Use it when planning OT incident response, isolation procedures, vendor coordination, and recovery readiness.

The inputs for this scenario

  • Affected OT systems or containment tasks: 28 tasks (unchanged)
  • Containment completion rate: 3.5 tasks / hr (unchanged)
  • Coordination and validation allowance: 52 % (raised for this scenario; the documented default is 45)

Working through the calculation

  • Applying the documented formula (Base cyber containment time = affected OT systems or containment tasks รท containment completion rate) to the inputs above produces each figure below.
  • At this operating point the engine returns 12.16 hr for required cyber containment time, the number this scenario is built around.
  • At this operating point the engine returns 8 hr for base cyber containment time.
  • At this operating point the engine returns 52 % for coordination and validation allowance.
  • At this operating point the engine returns 3.5 pieces / min for containment completion rate.

How this compares with the baseline

  • Against the tool's baseline example, where coordination and validation allowance sits at 45% and the headline result is 11.6 hr, this scenario comes in 4.83% above the baseline at 12.16 hr.
  • It computes the required containment time in hours by dividing affected OT systems or tasks by your containment completion rate, then padding the result with a coordination-and-validation allowance. The value of this scenario is the size of the gap it exposes: that gap, priced out over a year, is the budget you can justify spending to close it.

Results at a glance

  • Required cyber containment time: 12.16 hr (headline result)
  • Base cyber containment time: 8 hr
  • Coordination and validation allowance: 52 %
  • Containment completion rate: 3.5 pieces / min

Run it with your numbers

  • Every input above is editable in the live Mean Time to Contain Cyber calculator, which recalculates instantly and can be shared with the inputs intact.

Last reviewed 2026-05-12.