The "golden hour" is the single strongest predictor of intervention success: actions taken within 60 minutes of exploit detection preserve 82.5% of at-risk capital on average, while delays beyond 24 hours reduce effectiveness to 10.9%. This section introduces the Containment Success Rate (CSR) and benchmarks authority tiers against it.
The overall CSR across all 601 eligible cases is 26.0% ($2.51B of $9.60B). The distribution is bimodal: protocols either contain >80% of at-risk value (the "fast responders") or save almost nothing (the "too-late" cluster). A significant 44% of cases fall below a 10% CSR, indicating that current industry response capabilities leave most protocols unprotected.
Signer Sets respond in a median of 30 minutes but carry the lowest legitimacy score. Delegated Bodies achieve a median response of 4 hours with higher legitimacy. Governance votes average 30+ days, delivering the highest democratic legitimacy but rendering them unsuitable for real-time asset preservation—only 3 Governance-led responses occurred within 24 hours in the entire dataset.
Plotting response time against CSR reveals a sharp exponential decay: within 60 minutes, mean CSR is 82.5%; at 1–24 hours it drops to 38.1%; after 24 hours it falls to 10.9%. The decay curve is steepest in the first 2 hours, confirming that the "golden hour" is not metaphorical—it is a quantifiable operational threshold backed by 157 successful intervention cases.
Account × Delegated Body achieves the highest CSR at 92%, followed by Asset × Signer Set at 71%. Protocol × Governance scores lowest at 18% due to speed constraints. The leaderboard reveals that the combination of narrow scope and professionalised authority consistently outperforms any single-axis optimisation.
Risk-adjusting for attack complexity (vector severity × frequency) confirms that Delegated Bodies deliver the best return on security investment: each council-led intervention saves a median of $6.4M versus $1.2M for Signer Sets. However, Signer Sets handle 4× more cases by volume, making both tiers complementary in a tiered response architecture.