The number most vendors advertise measures the wrong thing. Here’s how to evaluate takedown speed claims and the metric that actually determines whether your customers are protected.
If you evaluate brand protection vendors, you have seen the speed claims. Marketing pages routinely advertise median takedown times under an hour, success rates above 95%, and in some cases, removal in under a minute. The numbers are designed to make comparison easy. The problem is that they measure different things, define success differently, and almost never disclose the methodology behind the figure.
The result is a market where the headline number is nearly useless for comparing vendors, and where the metric that actually determines whether your customers are protected is rarely the one being advertised.
Security teams evaluating these claims describe the gap in practical terms. One team told us they had been reporting fraudulent sites through their existing vendor for months without receiving a response. Another noted that their current provider would not initiate a takedown unless the customer supplied proof the site was malicious, by which point the damage was already done. A third said their primary evaluation question for any new vendor was simply: how effective are takedowns, really? Because that would tell them everything they needed to know about what was not working.
These are not unusual experiences. They reflect a structural problem in how takedown speed is measured, reported, and sold.
What "takedown time" actually measures
The phrase “takedown time” is used to describe at least three different things, and the distinction between them determines whether the number you are evaluating means anything.
The first is time to block or neutralize. This is the elapsed time between when a phishing site is detected and when victims are prevented from reaching it or from having their stolen credentials used. Blocking can happen through browser-level warnings, DNS-based redirection, or active countermeasures like injecting decoy credentials that render stolen data worthless. This is the fastest layer of response and the one most directly connected to victim protection.
The second is time to suspension. This is the elapsed time between when a takedown request is submitted and when the hosting provider or registrar suspends the domain or takes the page offline. The site appears to be down, but the underlying infrastructure, the domain registration, the hosting account, the phishing kit files, may remain intact. Suspension is faster than full removal but is also more easily reversed.
The third is time to full removal. This is the elapsed time until the domain is permanently deregistered, the hosting account is terminated, and the phishing kit artifacts are confirmed deleted. Full removal depends entirely on the cooperation of hosting providers, registrars, and in some cases multiple intermediaries across jurisdictions. No vendor controls this process end to end.
When a vendor advertises a takedown time, you are rarely told which of these three they are measuring. A claim of “under two minutes” almost certainly refers to blocking or automated suspension initiation, not confirmed removal. A claim of “33-minute median” may refer to the point at which a provider acknowledges the request, not the point at which the site is confirmed down. The number by itself, without the definition, is not comparable across vendors.
Why time-to-protection is the metric that matters
Academic research has documented the timing of victim arrivals at fraudulent sites with unusual precision. Within approximately four hours of a phishing site going live, 25% of the victims who will ever visit have already arrived. By ten hours, 75%. The APWG’s Q1 2026 Phishing Activity Trends Report documented 971,181 phishing attacks in a single quarter, up 13.8% from the prior period. At that volume, every hour a fraudulent site remains reachable translates to measurable harm.
A full-removal process that completes in 48 hours prevents very little of that harm. Even a fast suspension that completes in four hours catches victims only after the first quarter have already been exposed. The metric that connects directly to customer protection is time-to-blocking: the gap between when a threat is detected and when your customers can no longer reach it.
This is not an argument against takedowns. Takedowns matter. A site that is fully removed cannot be reactivated, cannot be re-indexed by search engines, and cannot accumulate new victims over time. But a takedown that arrives after the critical window has closed is a cleanup operation, not a protection mechanism. The two serve different functions, and evaluating a vendor primarily on takedown time is evaluating the cleanup while ignoring the protection.
Five questions that expose how a takedown number is built
If you are comparing vendors or evaluating a new provider, five questions will tell you whether the speed claim you are looking at means what you think it means.
What was taken down: the page, the domain, or just a suspension? A page removal leaves the domain and hosting intact. A domain suspension leaves the registration active. A full removal terminates all three. The distinction matters because suspended and partially removed sites can be reactivated.
Is the number a median, a best case, or an average? Medians hide the long tail. If a vendor reports a 30-minute median but the 90th percentile is measured in days, the number describes the easy cases while obscuring the difficult ones, which are where the most harm concentrates.
Across which hosting providers was it measured? Some providers cooperate within hours. Others take weeks. A takedown number measured only against cooperative providers is not representative of the threat surface your brand actually faces. APWG found that Cloudflare alone hosted 39% of all phishing sites reported in Q1 2026, illustrating how concentrated the hosting landscape is and how much a single provider’s responsiveness shapes the aggregate number.
Does “done” mean the site is confirmed down, or that a ticket was submitted? One security team described discovering that sites their vendor had marked as “taken down” were still live and serving phishing pages when checked from a different location. The gap between “request submitted” and “confirmed removed” can be days or weeks, and it is a gap some vendors count as zero.
Did it stay down, and for how long was it monitored? A success rate reported without a recurrence window is incomplete. Sites that come back after removal, through re-hosting, domain re-registration, or phishing kit redeployment, are not reflected in a one-time success metric. The question is not just whether the site went down but whether it stayed down.
What to look for in a phishing takedown vendor
The vendors doing this well share a few characteristics that are visible before you sign a contract.
They separate detection from response from removal and report each with its own metric rather than collapsing the entire lifecycle into a single number. Detection cadence should be measured in minutes. Blocking or neutralization should follow detection within minutes, not hours. Takedown and full removal should be tracked honestly, with timelines that reflect the host-dependent reality rather than cherry-picked best cases.
They protect victims during the removal process rather than treating the gap as unavoidable. Active countermeasures, such as injecting decoy credentials that degrade stolen data before a site is fully removed, mean the window between detection and removal is not an unprotected window.
They are transparent about methodology. The vendor willing to explain exactly how it defines “takedown,” which hosts its metrics include, and what its recurrence monitoring looks like is the vendor whose numbers you can trust. The vendor that publishes a headline stat with no supporting methodology is the one whose numbers you should question.
And they monitor for re-emergence after removal. A takedown is not a one-time event. It is a lifecycle that includes detection, blocking, removal, confirmation, and re-monitoring. The vendors that treat it as a lifecycle produce outcomes that hold. The ones that treat it as a ticket produce numbers that look fast and leave your customers exposed. For a deeper look at how to verify whether a takedown actually held, we examine the specific failure modes in a companion post.
The Bottom Line
The headline takedown number most vendors advertise is not the metric that protects your customers. Time-to-protection, the gap between when a threat appears and when your customers can no longer reach it, is the measure that maps to harm prevention. Full removal matters for long-term cleanup, but 75% of victims arrive within ten hours. The vendor whose blocking operates in minutes and whose removal operates with transparency is doing more for your customers than the vendor whose marketing page claims the fastest median. Ask how they define the number. Ask what it includes. Ask what happens in the gap. The answers will tell you more than the number itself.
Key Takeaways
Fast enough to protect victims before they arrive. Research shows 75% of victims reach a phishing site within ten hours of it going live. Blocking should operate in minutes. Full removal is host-dependent and typically takes longer, but active protection should not wait for it.
The term is used to describe three different things: time to block (prevent victims from reaching the site), time to suspension (hosting provider takes the page down), and time to full removal (domain deregistered, kit deleted). Most vendor claims do not specify which one they are reporting.
Ask five questions: What was taken down (page, domain, or suspension)? Is the number a median or best case? Which hosting providers were included? Does “done” mean confirmed down or ticket submitted? Did the site stay down?
The elapsed time between when a phishing site is detected and when your customers are prevented from reaching it. This is the metric that maps directly to harm prevention, as opposed to takedown time, which measures cleanup after most damage is already done.
Separate metrics for detection, blocking, and removal. Active protection during the removal gap (not just waiting for hosts to act). Transparent methodology. Recurrence monitoring after removal.
