The 2026 benchmark for adversary breakout time — the interval between an attacker establishing an initial foothold and beginning active data exfiltration — is 72 minutes. That represents a fourfold reduction from prior-year averages.
Put next to how most security operations actually run, that number is uncomfortable.
The arithmetic problem
Consider a realistic timeline in a reasonably well-run organisation:
| Stage | Typical elapsed time |
|---|---|
| Malicious activity occurs | T+0 |
| Telemetry reaches the SIEM | T+2 to T+15 min |
| Correlation rule fires, alert created | T+5 to T+20 min |
| Alert picked up from the queue | T+15 to T+90 min |
| Tier 1 triage and initial assessment | +10 to 30 min |
| Escalation to Tier 2 or IR | +15 to 60 min |
| Containment decision and approval | +15 to 120 min |
| Containment executed | +5 to 30 min |
Even an efficient path through that chain lands well past 72 minutes. A slow one takes most of a day. Outside business hours, in an organisation without 24/7 coverage, it takes until the next morning.
The attacker finished at minute 72. Everything after that is not incident response — it is cleanup and notification.
Why the collapse happened
Several factors compound:
Access is bought, not earned. Attackers increasingly begin with valid credentials purchased from an initial access broker or extracted from an infostealer log. The slow reconnaissance-and-exploitation phase has already been completed by someone else.
Tooling is automated. Post-exploitation frameworks handle discovery, credential harvesting, lateral movement and staging as scripted sequences rather than manual steps.
Objectives are simpler. Many operations now skip encryption entirely and go straight to bulk data theft. Exfiltration-only attacks do not require the careful, slow work of reaching and disabling every backup.
Cloud and SaaS collapse the distance. In a traditional network, an attacker had to move from a workstation through several hops to reach data. With a stolen session token to a SaaS platform, the foothold is the data access.
What actually closes the gap
The instinct is to hire more analysts. That does not work — the constraint is decision latency, not headcount.
Automate containment for high-confidence detections
This is the single highest-leverage change. For a defined set of high-fidelity signals, containment should execute automatically without human approval:
- Known ransomware behavioural patterns → isolate the host immediately.
- Credential dumping tool signatures on a domain controller → isolate and disable the account.
- Impossible travel plus a new MFA method registration → revoke all sessions for that identity.
- Mass file encryption behaviour → isolate and snapshot.
The objection is always false positives. It is a fair concern and the answer is scoping: start with a narrow set of detections where your historical false positive rate is near zero, measure for a quarter, then expand. An isolated laptop is a support ticket. An exfiltrated customer database is a regulatory event.
Cut telemetry latency
Audit how long it actually takes for endpoint and identity telemetry to become queryable in your platform. Teams are frequently surprised. Batch collection intervals measured in tens of minutes consume most of the available window before anyone even sees the data.
Detect earlier in the chain
Exfiltration detection is too late by definition. Push detection toward initial access and early discovery:
- Authentication anomalies at the identity provider.
- First-time-seen administrative tool execution on a host.
- Internal reconnaissance patterns — enumeration of shares, AD objects, cloud resources.
- New persistence mechanisms: scheduled tasks, services, run keys, cloud roles.
Pre-authorise containment
Approval delay is frequently the largest single component of response time. Establish standing authority for defined containment actions under defined conditions, agreed with business stakeholders in advance. An analyst at 3am should not be trying to reach a director for permission to isolate a laptop.
Reduce blast radius so speed matters less
Every architectural control that limits what a foothold can reach buys back time: network segmentation, least privilege, tiered administration, just-in-time access, and strict conditional access on the identity provider. These do not make you faster; they make the attacker's 72 minutes less productive.
Measure your own number
Before treating the benchmark as an abstraction, establish your own baseline. Take your last ten genuine incidents and compute the elapsed time from earliest attacker activity to containment. Most teams have never calculated this, and the result is usually sobering.
Then work the components. Telemetry latency, queue wait, triage duration, escalation, approval, execution. Each one is separately measurable and separately improvable, and the biggest win is rarely where people expect it to be.
