Key Takeaways
- The average time attackers spend inside a compromised network before exfiltrating data has dropped sharply—from 84 minutes in 2022 to just 29 minutes in 2025.
- Modern intrusions increasingly rely on stolen legitimate credentials (“logging in”) rather than exploiting software vulnerabilities, giving attackers the same privileges as authorized users.
- Detecting malicious activity now depends less on verifying whether an account is legitimate and more on assessing whether the account’s behavior deviates from established norms.
- Artificial intelligence is accelerating both offensive and defensive timelines: attackers use AI to weaponize zero‑day exploits faster, while defenders must patch vulnerabilities in days instead of months.
- Preparedness—regular incident‑response exercises, asset visibility, and board‑level risk oversight—is essential to shrink the defender’s reaction window and limit damage when breaches occur.
The Shrinking Breakout Time
Cybercriminals are completing their attacks far more quickly than in previous years. According to the CrowdStrike Global Threat Report 2026, the average “breakout time”—the interval between an attacker’s initial network entry and the moment they have stolen or destroyed data—was only 29 minutes in 2025. This figure represents a steep decline from 48 minutes in 2024, 62 minutes in 2023, and 84 minutes in 2022. The World Economic Forum’s Global Cyber Outlook Report 2026 warned that such speed and scale are pushing traditional defenses to their limits, forcing organizations to rethink how they detect and stop intrusions before significant harm is done.
Login‑Based Intrusions
A growing proportion of breaches now begin with attackers simply logging in using valid corporate usernames and passwords rather than exploiting software flaws. Adam Meyers, head of counter‑adversary operations at CrowdStrike, noted that over the past 18 months the dominant technique has shifted from phishing‑delivered exploits to the use of compromised identities. Criminals obtain these credentials through phishing, underground markets, or brute‑force attacks on weak or reused passwords. Once inside, the attacker inherits the same access rights as the legitimate user, enabling rapid lateral movement across SaaS and cloud applications and swift data exfiltration without the need to deploy malware or slowly escalate privileges.
Why Context Matters More Than Credentials
Because malicious activity can now look indistinguishable from normal user behavior, traditional identity‑centric defenses are insufficient. Gabrielle Hempel, security‑operations strategist at Exabeam, argued that defenders must shift focus from “is the account legitimate?” to “is the account’s behavior abnormal?” By layering business context, historical user‑behavior baselines, and environmental knowledge, security teams can spot deviations even when attackers use valid credentials. Behavioral analytics—once a niche capability—are becoming a core component of modern detection strategies, giving defenders a fighting chance despite the shrinking windows for response.
The AI Effect on Attack Speed
Artificial intelligence is compressing timelines on both sides of the cyber battlefield. Defenders are employing agentic AI and frontier large‑language models such as Mythos and GPT‑Cyber to uncover vulnerabilities at unprecedented speed and scale. However, this rapid discovery creates a patch‑management burden: security teams must now remediate flaws within days rather than the six‑month windows of the past. Meanwhile, attackers harness the same AI capabilities to automate zero‑day exploitation, scan for exposed services, and craft more efficient intrusion paths. In May 2026, Google’s Threat Intelligence Group reported that cybercriminals successfully used AI to identify and exploit a zero‑day vulnerability, illustrating how AI shortens both the time attackers need inside a network and the time defenders have to prevent or detect the breach.
Rapid Response Starts with Preparation
Given the accelerated pace of attacks, preparation is the linchpin of effective cyber resilience. Jonathan Ellison, director of national resilience at the UK National Cyber Security Centre, emphasized that the difference between organizations that cope well with an incident and those that falter lies in exercising response plans. Regular tabletop drills and live simulations build muscle memory, reducing confusion when a real incident occurs. Foundational practices—maintaining an up‑to‑date inventory of network assets, understanding the evolving threat landscape, and aligning cybersecurity investments with board‑level risk assessments—are critical. Ellison urged that cybersecurity be treated as a strategic boardroom issue: leaders must understand their exposure, allocate appropriate resources, and ensure they can respond and recover swiftly when the worst happens. In the race for cybersecurity, speed truly is of the essence, and only proactive preparation can tilt the odds in favor of the defender.