Average time to contain an insider incident: 67 days in 2025, down from 81 days in 2024; far longer than a checkpoint copy takes
67 daysobserved
| Value kind | observed — Reported measurements, counts, and specifications keep the precision and scope stated by their source; an exact specification is not treated as a range. |
|---|---|
| Scope | Time to contain in the study population, not a model-theft detection budget or time to copy a checkpoint. |
| As of | 2026 |
| Source | Ponemon Institute, 2026 Cost of Insider Risks Global Report (2025 data) · Ponemon blog on the 2026 Global Cost of Insider Risks: 'the average time to contain the incident decreased significantly in 2025 to 67 days from 81 days in 2024'. |
| Review | checking…review by 2027-05-01 · standard cadence |
| Recorded changes | last 2026-10-19 · 4 revisions tracked |
| Claim id | average-time-to-detect-and-contain-an-insider |
Where the guide uses it
← Full numbers register — every date-stamped figure in the guide, with revision history.