AI soc statistics show dwell time is outpacing breach speed

At a glance

What this is: Prophet’s AI SOC statistics show that breakout speed is outpacing human triage, with average eCrime breakout at 29 minutes and alert dwell time at 56 minutes.

Why it matters: For SOC, IAM, and identity teams, the finding matters because valid credentials and trusted access are now central to many intrusions, so slow investigation creates an identity governance blind spot as well as an operations problem.

By the numbers:

• Average eCrime breakout time fell to 29 minutes, with the fastest observed at 27 seconds.
• Security teams face an average of 960 alerts per day.
• About 40 percent of alerts are never investigated.
• Average alert dwell time before triage is 56 minutes.

Context

Security operations break down when alert volume, breakout speed, and triage capacity move on different clocks. In this article, the core problem is not simply too many alerts, but that defenders are looking at attacker behaviour after the attacker has already progressed. The identity angle is real because the cited intrusions rely heavily on valid credentials and trusted access rather than obvious malware.

That creates a governance problem for SOC and IAM leaders at the same time. If malicious activity looks like legitimate identity use, then detection quality depends on how quickly teams can correlate authentication behaviour, access scope, and lateral movement. The article’s starting position is typical for modern cloud and SaaS environments, where trusted access often hides the attack path.

Key questions

Q: What breaks when alert dwell time is longer than attacker breakout time?

A: The SOC loses its ability to prevent lateral movement and becomes a post-event investigation function. When triage starts after the attacker has already moved, containment is still possible, but the chance to block spread early is gone. That is why dwell time has to be measured against adversary speed, not just internal service levels.

Q: Why do valid credentials create harder-to-detect breaches?

A: Valid credentials bypass many traditional security signals because the access looks legitimate at the protocol level. The abuse shows up in identity context, not in obvious malware or exploit indicators. That is why teams need behavioural baselines for machine identities, not just perimeter alerts or signature-based detections.

Q: How do organisations measure whether AI-powered security workflows are actually improving SOC performance?

A: Organisations should track operational metrics such as mean time to respond, alert reduction, and automation success rate. Those signals show whether workflows are reducing analyst load and improving containment speed. Good measurement also includes audit readiness and the quality of workflow outputs, because fast automation is only useful if it remains accurate and defensible.

Q: Should organisations prioritise alert reduction or investigation speed first?

A: Investigation speed should come first when attacker movement is already faster than human triage, because a smaller queue still fails if decisions arrive too late. At the same time, alert reduction is necessary when low-signal noise prevents teams from focusing on identity-relevant events. The right sequence is speed on the critical path, then noise reduction around it.

Technical breakdown

Why breakout time matters more than alert count

Breakout time measures the interval between initial compromise and lateral movement. That is the operational clock that determines whether triage can still prevent spread or only document it after the fact. Alert count matters, but the more important question is whether the SOC can turn an incoming signal into a decision before an attacker reuses trusted access to move. In environments where intrusions are already living off the land, speed of analysis becomes a control surface, not just a workflow metric.

Practical implication: measure detection-to-triage latency against attacker breakout time, not against your own queue targets.

Why valid credentials make SOC triage look slow

When adversaries use valid credentials, trusted identity flows, and approved SaaS integrations, they do not need noisy payloads to stand out. That means detections often reflect normal business activity until the pattern is correlated across identity, cloud, and endpoint telemetry. The technical problem is therefore one of trust boundaries: systems are behaving as designed, but for the wrong actor. This is why identity context is essential to SOC analysis, especially where service accounts, tokens, and delegated access are involved.

Practical implication: enrich detections with identity context so investigators can distinguish legitimate access from abused access.

Why uninvestigated alerts are a control failure, not a staffing complaint

A high percentage of uninvestigated alerts usually signals a broken prioritisation model, not merely analyst fatigue. If the SOC cannot close the loop on the majority of alerts, then the environment is effectively accepting unknown risk at scale. The article’s numbers show how this happens: high daily alert volume, low investigation coverage, and triage that begins after attacker movement has already occurred. At that point, the control gap is not visibility alone but decision latency across the entire response chain.

Practical implication: tune alert suppression, enrichment, and escalation so only identity-relevant events consume human triage time.

Threat narrative

Attacker objective: The attacker aims to move laterally under trusted identity and complete compromise before human triage can intervene.

1. Entry begins with malware-free intrusion through valid credentials or trusted access rather than a droppable payload, which lets the attacker blend into normal activity.
2. Credential use and identity trust then support lateral movement before defenders complete triage, especially when access patterns resemble approved SaaS or cloud behaviour.
3. Impact follows when the attacker has already moved inside the environment by the time the alert is opened, limiting the defender to containment and recovery rather than prevention.

Breaches seen in the wild

• JumpCloud breach 2023: North Korean hackers breached JumpCloud and abused its device commands framework against a few customers; all admin API keys were reset.
• AnyDesk breach 2024: Attackers compromised AnyDesk's production systems; it revoked its code signing certificate and reset all portal passwords. Stolen keys were reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI SOC dwell time is now an identity governance problem as much as an operations problem. When adversaries move through valid credentials and trusted access, the SOC is not only racing a faster attacker, it is evaluating legitimate-looking identity events after the fact. That changes the governance burden for IAM and SOC leaders. The practitioner conclusion is that identity context must be treated as a first-class investigation signal.

Alert volume is not the core failure mode. Decision latency is. The article shows that teams can face hundreds or thousands of alerts per day, yet the real risk is the time it takes to separate identity abuse from normal access. In governance terms, the control gap is not just too many alerts but too little prioritisation around the events most likely to carry attacker movement. The practitioner conclusion is that triage design has to be risk-ranked, not queue-ranked.

Trusted access has become the new concealment layer for intrusion. The article’s emphasis on malware-free detections means the attacker no longer needs obvious tooling to get noticed. That creates what amounts to a verification trust gap: security tools can see activity, but they cannot reliably tell whether the activity is authorised fast enough to stop spread. The practitioner conclusion is that access provenance and session-level identity evidence now matter to detection engineering.

Attack speed is forcing a redesign of security operating assumptions. A SOC model that assumes investigators will have more time than the attacker is already obsolete in environments built on cloud, SaaS, and delegated access. The article validates a broader market shift toward automation, but automation only helps if it shortens the path from signal to decision. The practitioner conclusion is to re-evaluate whether current SOC workflows can still protect the identity layer.

AI SOC adoption will be judged by governance quality, not enthusiasm. The article’s adoption and barrier data suggest that privacy, integration, and auditability decide whether AI becomes operational or remains aspirational. In identity-heavy environments, that means governance over data access, retention, and explanation quality matters as much as model accuracy. The practitioner conclusion is that AI in the SOC must be evaluated as a governed operating capability, not a point feature.

What this signals

AI SOC programmes now need identity-aware triage, not just more automation. The practical question is whether the SOC can distinguish trusted access from abused access before the attack chain advances. That pushes organisations toward richer identity telemetry, better prioritisation, and tighter linkage between IAM and detection workflows.

The governance gap is becoming visible in the gap between detection and action. When alerts are opened after the attacker has already moved, the issue is not only volume but operating design. Teams should expect evaluation pressure to shift toward response latency, identity context, and the quality of investigation evidence rather than raw alert throughput.

For practitioners

• Measure triage against attacker breakout time Compare mean time to first triage with external breakout benchmarks such as 29 minutes, then reset escalation thresholds where defenders are consistently slower than likely attacker movement.
• Add identity context to SOC detections Prioritise detections that include authenticated user, service account, token, and SaaS integration context so analysts can separate trusted access from abused access.
• Reduce the pool of uninvestigated alerts Suppress low-signal noise, consolidate overlapping rules, and route only identity-relevant events to human triage so the queue does not grow faster than the team can close it.
• Test AI governance before scaling automation Validate data retention, audit trails, and privacy controls for any AI SOC workflow that touches identity or alert content before expanding its production scope.

Key takeaways

• AI SOC statistics show that human triage is already slower than modern attacker movement, which turns dwell time into a governance issue as well as an operational one.
• The most important evidence in the article is not alert volume alone but the combination of 29-minute breakout, 56-minute dwell time, and a high share of uninvestigated alerts.
• Security teams should design SOC workflows around identity context, faster prioritisation, and measurable response latency if they want AI to change outcomes rather than just reporting.

Key terms

• Alert Dwell Time: The time between an alert being generated and a human analyst beginning triage. In practice, it measures how long a signal sits in the queue before the organisation starts making containment decisions, which makes it a direct indicator of operational responsiveness.
• Breakout Time: The interval between initial compromise and the point where an attacker can move laterally or expand control. It is a useful attacker-speed benchmark because it shows how quickly defenders must detect and contain an intrusion before it spreads.
• Trusted Account Abuse: The use of a legitimate, compromised identity to send malicious messages or perform unauthorized actions. Because the account already has reputation and context, defenders often miss it until the abuse spreads beyond the first target.
• Identity Triage: Identity triage is the rapid process of determining whether an authentication alert indicates harmless behaviour or active compromise. It relies on system logs, session data, and behavioural context to reduce ambiguity quickly. In mature programmes, it is a repeatable workflow rather than an ad hoc analyst judgement.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control design to the broader security workflows their programmes depend on.