While unnoticed, attackers can:<\/p>\n\n\n\n
- \n
- identify valuable systems;<\/li>\n\n\n\n
- steal credentials and escalate privileges;<\/li>\n\n\n\n
- move laterally;<\/li>\n\n\n\n
- establish persistence;<\/li>\n\n\n\n
- prepare data theft.<\/li>\n<\/ul>\n\n\n\n
Cyberespionage and North Korean IT worker cases each had a 122-day median, with legitimate credentials and living-off-the-land techniques helping activity blend in.<\/p>\n\n\n\nWhy internal detection matters<\/h2>\n\n\n\n
Organizations identified 52% of compromises internally in 2025<\/strong>, up from 43% in 2024. These incidents had a nine-day median dwell time<\/strong>. The findings highlight the value of internal visibility, without proving that any particular technology reduces dwell time. <\/p>\n\n\n\n
The operational challenge is turning telemetry into action while attacks are still unfolding. <\/p>\n\n\n\n
Data theft can happen in minutes<\/h2>\n\n\n\n
Palo Alto Networks measures time to exfiltration<\/strong>, from initial compromise to confirmed data theft. This differs from dwell time; the figures are not directly comparable. <\/p>\n\n\n\n
Its 2025 incident-response dataset showed:<\/p>\n\n\n\n
- \n
- the fastest quarter reached exfiltration in 72 minutes<\/strong>;<\/li>\n\n\n\n
- the previous year’s equivalent was 285 minutes<\/strong>;<\/li>\n\n\n\n
- 22% of cases<\/strong> reached exfiltration in less than one hour;<\/li>\n\n\n\n
- median time across the dataset was two days<\/strong>.<\/li>\n<\/ul>\n\n\n\n
Detection that appears fast by dwell-time standards may therefore arrive after data theft.<\/p>\n\n\n\nWhy SOCs need both speed and long-term visibility<\/h2>\n\n\n\n
Rapid intrusions and months-long concealment demand:<\/p>\n\n\n\n
- \n
- Prioritization:<\/strong> recognize urgent signals within routine alerts. <\/li>\n\n\n\n
- Context:<\/strong> connect users, hosts, events and threat intelligence.<\/li>\n\n\n\n
- Investigation speed:<\/strong> establish what happened without unnecessary delay. <\/li>\n\n\n\n
- Historical visibility:<\/strong> correlate activity across longer periods.<\/li>\n\n\n\n
- Analyst capacity:<\/strong> reduce repetitive work that obscures important signals.<\/li>\n<\/ul>\n\n\n\n
Mandiant also recommends proactive threat hunting to close visibility gaps and reduce adversary dwell time, rather than relying solely on reactive alerts.<\/p>\n\n\n\nShortening the path from alert to decision<\/h2>\n\n\n\n
PULZARIS Analyst Agent<\/strong> <\/a>supports post-alert investigations through triage, entity and context mapping, threat-intelligence enrichment, prioritization and analyst-ready recommendations. Human analysts retain responsibility for validation and final decisions. <\/p>\n\n\n\n
AI cannot promise to eliminate dwell time or prevent every exfiltration attempt. Its role is to shorten the path from signal to understanding and decision<\/strong>, helping defenders use their available time more effectively. <\/p>\n\n\n\n
Read the full article on our International subsidiary\u2019s website by clicking on the logo:<\/a><\/a><\/a><\/a><\/a><\/a><\/a><\/a><\/a><\/a><\/a><\/p>\n\n\n\n
![\"\"](\"https:\/\/euroone.hu\/wp-content\/uploads\/2024\/10\/socwise-poweredArtboard-1@4x-100.jpg\")
<\/a><\/figure>\n\n\n\nDo you have a question? Are you interested in the solution? Contact our colleagues! <\/h3>\n\n\n\n
\n\n<\/p>
- <\/ul><\/div>\n
- Context:<\/strong> connect users, hosts, events and threat intelligence.<\/li>\n\n\n\n
- the previous year’s equivalent was 285 minutes<\/strong>;<\/li>\n\n\n\n
- the fastest quarter reached exfiltration in 72 minutes<\/strong>;<\/li>\n\n\n\n