Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Modern incident response is too slow for attacks that move laterally in minutes, with containment now needing to be architectural rather than a later response step, according to Zero Networks. The core assumption that detection must happen before isolation has collapsed, and enterprises need closed-by-default controls that limit blast radius even when alerts never fire.
NHIMG editorial — based on content published by Zero Networks: Incident Response vs. Breach Containment: Modernizing Cyber Resilience and Recovery
By the numbers:
- It takes an average of 247 days to identify and contain a breach, while attackers typically begin moving laterally in less than 30 minutes.
- Attackers begin moving laterally in as little as 27 seconds, while average breakout time now sits at 29 minutes.
- 80% of cyber incidents are malware-free attacks, ee attacks, as adversaries increasingly abuse legitimate tools and applications to hide in normal traffic.
Questions worth separating out
Q: How should security teams design incident response when attackers move faster than detection?
A: They should make containment independent of detection so isolation can happen even when alerts are late or noisy.
Q: Why do standing privileges make breach containment harder?
A: Standing privileges give attackers reusable internal reach after they get in, which lets them move laterally and escalate without repeatedly triggering new access decisions.
Q: What breaks when containment is weaker than detection?
A: Detection may still find suspicious activity, but it arrives after the attacker has already used the available internal paths.
Practitioner guidance
- Rebuild incident response around containment-first design Rewrite playbooks so isolation can occur without waiting for detection, approval chains, or full incident classification.
- Map privileged paths to identity and protocol scope Document which users, service accounts, and applications can reach sensitive assets, then narrow those paths to approved protocols and business need.
- Replace standing access with time-bound elevation Use just-in-time MFA and automatic revocation for sensitive administrative pathways so elevated access expires as soon as the task ends.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- A practical framework for designing automated breach containment as a built-in feature of the network
- Identity-based microsegmentation examples that tie access to users, devices, applications, and approved logon types
- Just-in-time MFA guidance for privileged pathways and sensitive protocols
- How deterministic policy automation keeps containment current as the environment changes
👉 Read Zero Networks' analysis of incident response and breach containment →
Incident response vs breach containment: are your controls keeping up?
Explore further
02/09/2026 1:30 pm
Closed-by-default containment is becoming the real control objective. Reactive incident response assumes detection, investigation, and coordination all happen before the attacker meaningfully expands. That assumption was built for slower adversaries and breaks when breakout happens in minutes or seconds. The implication is that containment architecture now deserves the same governance attention that identity governance and access reviews already receive.
A few things that frame the scale:
- More than 80% of cyber incidents are malware-free attacks, as adversaries increasingly abuse legitimate tools and applications to hide in normal traffic, according to the 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
Q: How do identity-based microsegmentation and just-in-time access work together?
A: Microsegmentation limits where an identity can move, while just-in-time access limits how long elevated access exists. Used together, they reduce both the reachable attack surface and the time an attacker can reuse privilege. That combination is most effective when sensitive paths are tied to business need rather than broad internal trust.
👉 Read our full editorial: Incident response is giving way to containment-first cyber resilience
