Average time to contain an insider incident: 67 days, down from 86 in 2023; far longer than a checkpoint copy takes
67 daysobserved
| Value kind | observed — Reported measurements, counts, and specifications keep the precision and scope stated by their source; an exact specification is not treated as a range. |
|---|---|
| Scope | Time to contain in the study population, not a model-theft detection budget or time to copy a checkpoint. |
| As of | 2026 |
| Source | Ponemon Institute, 2026 Cost of Insider Risks Global Report; DTEX sponsor report page. Study observations concern 2025. · Essential Insights: 67 days to containment, down from 86 in 2023. |
| Review | checking…review by 2027-05-01 · standard cadence |
| Recorded changes | last 2026-09-16 · 3 revisions tracked |
| Claim id | average-time-to-detect-and-contain-an-insider |
Where the guide uses it
← Full numbers register — every date-stamped figure in the guide, with revision history.