Faster attacks: prevention beats postmortem analysis

Twenty-nine minutes is not an incident response window. It is a coffee break with regulatory paperwork waiting at the bottom. According to Infosecurity Magazine deputy editor Danny Palmer, citing the CrowdStrike Global Threat Report 2026, the average breakout time for an intrusion during 2025 was 29 minutes. Somewhere, a tabletop exercise just quietly deleted its optimistic assumptions. That number matters because enterprise defense has often treated discovery like archaeology: dig carefully, preserve artifacts, reconstruct the civilization that got owned. Palmer reports that unauthorized intruders previously spent weeks or months inside compromised networks preparing to steal data or plant malware. Now, Infosecurity Magazine says an attacker can move from initial entry to data access and exfiltration "in a matter of minutes." The plot has changed from slow burn thriller to convenience store robbery, except the cash register is your customer database.

What happened, according to Infosecurity Magazine Infosecurity

Magazine frames the core shift as a compression of the intrusion timeline. Palmer writes that breakout time is the window between initial network entry and the attacker leaving after stolen or destroyed data. CrowdStrike, as cited by Infosecurity Magazine, put the 2025 average at 29 minutes, which is fast enough to make some traditional escalation paths look like they were carved into stone tablets. The breach breakdown is therefore less about one victim and more about a busted operating model. If the valuable part of the intrusion can finish before a human committee has agreed which dashboard is the real dashboard, the strategy cannot depend on heroic investigation alone. Investigations still matter, because you need scope, evidence, and a defensible account of what happened. But they are no longer the first line of survival.

The investigation-first reflex is too slow, according to Infosecurity Magazine

According to Infosecurity Magazine, the old pattern gave defenders more time because intruders could spend weeks or months laying groundwork. That world rewarded deep detection, careful triage, and patient forensic reconstruction. The faster pattern punishes any security process that needs a person to notice, interpret, approve, and contain before data leaves. This is the counterintuitive lesson: faster attacks do not mean organizations should simply investigate harder. They mean security design has to reduce what a successful first step can accomplish. Prevention, segmentation, identity controls, and rapid containment become architectural requirements rather than nice slides in a quarterly risk review. If every compromised account opens the same hallway, the attacker does not need genius, only momentum.

Why the strategy shifts, using Infosecurity Magazine's timeline Infosecurity

Magazine's timeline comparison changes the defender's job from catching a long residency to interrupting a sprint. A weeks-long intrusion gives monitoring teams chances to observe patterns, correlate events, and build confidence. A minutes-long intrusion demands that systems already know which access is excessive, which movement is abnormal, and which data paths should not exist for ordinary work. That is where segmentation earns its rent. The point is not to make the network magically safe, a phrase that belongs in the same drawer as expired vendor stickers. The point is to make each step cost the attacker more time and permission. Identity controls serve the same purpose: fewer standing privileges, tighter access boundaries, and fewer assumptions that a logged-in session deserves a royal procession through sensitive systems.

What it actually means for you, from Infosecurity Magazine's numbers Palmer's

Infosecurity Magazine reporting gives security leaders a practical test: can your environment limit damage inside a 29 minute average breakout window. If the answer depends on someone reading an alert, opening a ticket, finding the owner, and waiting for approval, congratulations, you have built a suspense novel. The attacker has probably skipped to the last chapter. For builders, the takeaway is to design for containment before the incident. Segment systems so one foothold does not become a guided tour. Review identity paths as if every unnecessary privilege is a future apology draft. Keep investigations sharp, but make them the learning loop after prevention and containment have already done their rude, necessary work. The next thing to watch is whether enterprise security programs start measuring control quality against attacker speed, not just alert volume or mean time to close. Infosecurity Magazine's CrowdStrike coverage suggests the useful question is no longer only what happened after entry. It is how little an attacker can reach before your environment starts saying no.