Incident response teams are measured against attacker timelines that have shrunk from days to minutes, yet most organisations still quote a dwell time figure from a report several editions old. This page collects the incident response performance data that responders themselves publish: dwell time, who detects the intrusion, how fast attackers move after initial access, how intrusions start, and how prepared organisations are to respond. Every figure carries the report, the publisher and the edition year, taken from the publisher's own page. Cost and breach count figures sit in the Data Breach Statistics Guide and are not repeated here. It is written for incident response leads, SOC managers and executives building a case for faster detection and containment. Last reviewed: November 2026.
Key takeaways
- Dwell time went up, not down. Mandiant's M-Trends 2026 puts the global median dwell time at 14 days for intrusions investigated in 2025, up from 11 days the year before, ending a long run of improvement.
- Organisations now find more intrusions themselves. M-Trends 2026 reports that 52% of intrusions were first detected internally, up from 43% in 2024, so in close to half of cases someone outside still raises the alarm.
- Attackers move in minutes once inside. The CrowdStrike 2026 Global Threat Report gives an average eCrime breakout time of 29 minutes and a fastest of 27 seconds, and M-Trends 2026 found the median hand-off between initial access brokers and follow-on groups fell to 22 seconds.
- Data leaves fast in the worst cases. The 2026 Unit 42 Global Incident Response Report finds the fastest quarter of intrusions reached exfiltration in 72 minutes, down from 285 minutes, while the median across all cases was two days.
- Preparation is still the exception in smaller organisations. The UK Cyber Security Breaches Survey 2025/2026 finds only 25% of businesses have a formal incident response plan, against 76% of large businesses.
Headline statistics
Figures are from the latest edition we could read on each publisher's site in November 2026. Each report uses its own sample and definitions, described in the methodology section below.
| Statistic | Figure | Source, publisher and edition |
|---|---|---|
| Global median dwell time | 14 days (11 days the year before) | M-Trends 2026, Mandiant (Google Cloud) |
| Intrusions first detected internally | 52% (43% in 2024) | M-Trends 2026, Mandiant |
| Median dwell, espionage and North Korean IT worker cases | 122 days | M-Trends 2026, Mandiant |
| Average eCrime breakout time | 29 minutes, 65% faster than 2024 | 2026 Global Threat Report, CrowdStrike |
| Fastest eCrime breakout time | 27 seconds | 2026 Global Threat Report, CrowdStrike |
| Median hand-off from initial access to secondary group | 22 seconds (more than 8 hours in 2022) | M-Trends 2026, Mandiant |
| Fastest quartile time to exfiltration | 72 minutes (285 minutes the year before) | 2026 Global Incident Response Report, Unit 42 (Palo Alto Networks) |
| Median time to exfiltration | Two days | 2026 Global Incident Response Report, Unit 42 |
| Mean time to exploit a vulnerability | An estimated minus 7 days (exploitation before patch release) | M-Trends 2026, Mandiant |
| UK businesses with a formal incident response plan | 25% (76% of large businesses) | Cyber Security Breaches Survey 2025/2026, UK DSIT |
Dwell time and detection source
Dwell time is the number of days between the start of an intrusion and its detection. It is the single most quoted incident response number, and the one most often quoted out of date.
- Global median: M-Trends 2026, based on more than 500,000 hours of Mandiant incident investigations conducted globally in 2025 and published on 23 March 2026, reports a global median dwell time of 14 days, up from 11 days in the previous edition.
- Long-tail intrusions: the same report gives a median dwell time of 122 days for both cyber espionage incidents and North Korean IT worker incidents, and describes BRICKSTORM activity with dwell times of nearly 400 days. These are the intrusions that survive because they avoid the detections most programmes rely on, often on edge and virtualisation devices without endpoint agents.
- Who detects first: M-Trends 2026 reports that organisations first detected evidence of malicious activity internally 52% of the time, up from 43% in 2024. The remainder were notified by an external party, which includes law enforcement, a security vendor or the attacker in an extortion demand. The public blog post does not give dwell times split by detection source, so we do not quote one.
- How to read the rise: a higher median can mean slower detection or a change in case mix, for example more espionage and insider-style cases in the sample. Treat any one-year movement as a signal to check your own data, not as proof that defenders got worse.
Breakout, hand-off and exfiltration speed
Dwell time measures how long attackers stay hidden. Breakout and exfiltration times measure how long responders have before the damage is done, and they are now far shorter than most escalation processes.
| Speed measure | What it means | Figure, source and edition |
|---|---|---|
| Average eCrime breakout time | Time from initial compromise to lateral movement onto another host | 29 minutes, 65% faster than 2024 (CrowdStrike 2026 Global Threat Report) |
| Fastest recorded breakout | Shortest observed time to lateral movement | 27 seconds, the fastest on record (CrowdStrike 2026) |
| Access hand-off | Median time from initial access to hand-off to a secondary threat group | 22 seconds in 2025, more than 8 hours in 2022 (M-Trends 2026) |
| Fastest quartile exfiltration | Time from initial access to data leaving, fastest 25% of cases | 72 minutes, down from 285 minutes (Unit 42 2026) |
| Exfiltration under one hour | Share of incidents with exfiltration inside the first hour | 22%, up from 19% (Unit 42 2026) |
| Median exfiltration | Median across the full case set | Two days (Unit 42 2026) |
| Simulated AI-assisted attack | Unit 42 test of an AI-assisted attack chain | 25 minutes to exfiltration (Unit 42 2026) |
- Malware-free activity: the CrowdStrike 2026 Global Threat Report finds 82% of detections in 2025 were malware-free, meaning attackers used valid credentials, built-in tools and remote access software. Signature-based detection alone will not catch most of the activity that drives breakout.
- Remote access tools: Unit 42 2026 reports that 39% of command-and-control techniques observed related to remote access tools (ATT&CK T1219 Remote Access Tools).
- Cloud: CrowdStrike 2026 reports a 266% increase in cloud-conscious intrusions by state-nexus actors. See the Cloud Incident Response Guide for the logging and containment steps that change in cloud.
How intrusions start: what responders see
Responder data differs from breach notification data because it covers intrusions investigated in depth, including those that never became a reportable breach. Two 2026 datasets agree that exploitation and identity abuse dominate.
| Initial access vector | M-Trends 2026 (Mandiant) | Unit 42 2026 | ATT&CK technique |
|---|---|---|---|
| Exploits of vulnerabilities | 32%, top vector for the sixth consecutive year | 22% | T1190 Exploit Public-Facing Application |
| Phishing by email | 6% | 22% (phishing) | T1566 Phishing |
| Voice phishing and other social engineering | 11% (highly interactive voice phishing, second most common) | 11% (other social engineering) | T1566.004 Spearphishing Voice |
| Prior compromise or stolen credentials | 10% (prior compromise) | 13% previously compromised credentials, 8% brute force | T1078 Valid Accounts |
- Ransomware entry: M-Trends 2026 reports prior compromise as the top initial vector in ransomware cases at 30%, double the 15% seen in 2024. Access bought from or handed over by another group is now the leading way ransomware begins in Mandiant's data.
- Identity in the chain: Unit 42 2026 finds identity weaknesses played a material role in nearly 90% of investigations and identity-based techniques drove 65% of initial access. It also reports 87% of intrusions involved activity across two or more attack surfaces, and browser activity in 48% of investigations.
- Time to exploit: M-Trends 2026 estimates the mean time to exploit at minus 7 days, meaning exploitation routinely occurs before a patch is released. Patch speed alone cannot close that window; detection and containment on edge devices must.
- Breach dataset view: the Verizon 2026 DBIR, covering 1 November 2024 to 31 October 2025, also puts vulnerability exploitation first at 31% of breaches and finds ransomware in 48% of breaches.
Extortion and recovery outcomes
- Encryption is declining as a tactic: Unit 42 2026 reports encryption in 78% of extortion cases, down from 92%, with data theft in 57% and harassment in 10%. Responders increasingly face pure data theft extortion where restoring from backup is not the whole answer.
- Demands and payments: the same report gives a median initial ransom demand of $1.5 million (up from $1.25 million) and a median payment of $500,000 (up from $267,500).
- Backups decide the outcome: Unit 42 2026 finds 41% of victims restored systems from backup without paying, while attackers impacted backups in 26% of extortion cases. M-Trends 2026 describes a shift towards recovery denial tactics aimed at backups and recovery tooling.
- Preventable gaps: Unit 42 2026 reports more than 90% of intrusions involved preventable gaps in coverage or controls.
Ransomware prevalence and payment trends are covered in more depth in the Ransomware Statistics Guide.
Incident response readiness
The UK Cyber Security Breaches Survey 2025/2026, published by the Department for Science, Innovation and Technology on 30 April 2026 (fieldwork August to December 2025, 2,112 businesses and 1,085 charities), is one of the few government sources that measures response preparedness directly.
| Readiness measure | Businesses | Charities |
|---|---|---|
| Formal incident response plan | 25% (micro 21%, medium 57%, large 76%) | 19% |
| Roles or responsibilities assigned to individuals | 39% | 31% |
| Written guidance on who to notify | 34% | 28% |
| Guidance on when to report externally | 32% | 30% |
| Most disruptive breach reported outside the organisation | 40% | 36% |
| Directors or trustees informed of the incident | 81% | 84% |
| Internal record kept of the incident | 62% | 73% |
| Action taken to prevent future incidents | 61% | 57% |
The gap between large and micro businesses is the clearest finding: three in four large businesses have a plan, one in five micro businesses do. The Small Business Incident Response Guide and the Incident Response Plan Template are written for that gap.
What the numbers mean for defenders
The table maps each finding to the response capability it argues for and to NIST CSF 2.0 and SP 800-53 Rev. 5.
| Finding | Priority capability | NIST CSF 2.0 | SP 800-53 Rev. 5 |
|---|---|---|---|
| 29 minute average breakout, 22 second hand-off | Pre-authorised containment: host isolation, session and token revocation without waiting for a change board | RS.MA | IR-4 Incident Handling |
| 48% of intrusions not first detected internally | Detection coverage on edge, identity and SaaS telemetry, not only endpoints | DE.CM, DE.AE | SI-4 System Monitoring, AU-6 |
| 82% malware-free detections; identity in nearly 90% of cases | Identity threat detection and credential revocation playbooks | DE.AE, RS.AN | IR-4, IR-5 Incident Monitoring |
| Backups impacted in 26% of extortion cases | Isolated, tested backups and a rehearsed recovery plan | RC.RP | CP-10 System Recovery and Reconstitution |
| Only 25% of UK businesses have a formal plan | A written, exercised incident response plan with named roles | RS.MA, ID.IM | IR-8 Incident Response Plan, IR-3 Incident Response Testing |
| Only 40% of affected UK businesses report the most disruptive breach externally | Notification decision criteria written into the plan | RS.MA | IR-6 Incident Reporting |
- Measure your own dwell time: take the first malicious event and the detection timestamp from each closed incident. Industry medians are context; your own trend is the metric. See the Security Operations Metrics Guide for definitions.
- Size containment to breakout, not to office hours: if your median time from alert to isolation is longer than 29 minutes, the average eCrime actor has already moved laterally.
- Revoke machine credentials too: with identity techniques behind 65% of initial access in Unit 42's data, containment that resets user passwords but leaves API keys, OAuth tokens and service account secrets live leaves the door open. See the Incident Response Guide.
Methodology notes and caveats
- M-Trends: Mandiant incident response engagements, so the sample skews to serious intrusions at organisations that hired an external responder. Medians, not means.
- CrowdStrike: breakout time comes from CrowdStrike's own threat hunting and intelligence telemetry on eCrime intrusions; it is not a survey.
- Unit 42: more than 750 incident response engagements, cases from 1 October 2024 to 30 September 2025. Quartile figures describe the fastest cases, not the typical one.
- UK Cyber Security Breaches Survey: a representative telephone and online survey of UK organisations; self-reported, and most respondents are micro and small businesses.
- Do not mix definitions: dwell time, breakout time and time to exfiltration measure different intervals. Quote each with its own definition and edition.
Practitioner checklist
- Record first malicious activity, detection, containment and recovery timestamps for every incident, and report the median quarterly.
- Track the share of incidents detected internally versus notified externally and set a target above the M-Trends 2026 figure of 52%.
- Pre-approve containment actions (host isolation, account disable, token and key revocation) so responders can act inside 30 minutes.
- Include non-human identities in containment playbooks: API keys, OAuth grants, service accounts and CI/CD secrets.
- Extend detection to edge devices, virtualisation hosts and SaaS logs, where long-dwell intrusions hide.
- Test restore from isolated backups at least twice a year and check backups are out of reach of domain administrator credentials.
- Write external notification criteria and contacts into the plan, then exercise them in a tabletop. See the Tabletop Exercise Guide.
- Refresh every statistic you quote internally each spring, when the main annual reports are published.
Standards and references
- Google Cloud (Mandiant): M-Trends 2026, Data, Insights and Strategies From the Frontlines
- Palo Alto Networks Unit 42: 2026 Global Incident Response Report
- CrowdStrike: 2026 Global Threat Report
- UK Department for Science, Innovation and Technology: Cyber Security Breaches Survey 2025/2026
- Verizon: 2026 Data Breach Investigations Report
- NIST: SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Incident Response Guide · Data Breach Statistics Guide · NIST SP 800-61 Incident Response Guide · SOC and Alert Statistics · Identity Attack Statistics Guide