“If an intruder is already inside your network, how long have you got?” That once-hypothetical question used to be answered in hours or days. A new industry analysis suggests the answer is now measured in minutes. ReliaQuest reports the median time from initial compromise to lateral movement — the moment an attacker breaks out from a foothold to other systems — has collapsed to just 18 minutes. For defenders who planned on time to detect, investigate, and contain, that contraction changes the playbook.
Lateral movement: what 18 minutes means
The latest data paints a stark picture: attackers are moving laterally at unprecedented speed, compressing stages of the intrusion life cycle into a rapid sequence. Where defenders once counted on manual triage and lengthy investigations, adversaries now automate credential theft, reuse tooling, and exploit permissive trust relationships to escalate privileges and reach critical assets within minutes. This shift doesn’t merely shorten a metric — it forces a re-evaluation of controls, architecture, and operational priorities.
For years, security teams tracked “dwell time” — how long an adversary remains undetected — and modeled intrusions as a chain of events with pauses for detection and response. ReliaQuest’s finding, amplified in coverage by Infosecurity Magazine, undermines that assumption. Attackers are increasingly leveraging living-off-the-land techniques, scripted workflows, and commoditized toolkits that transform what used to be discrete phases into near-instantaneous actions. The result: defenders who lack automated prevention and rapid containment face an existential risk once lateral movement begins.
Why the speed-up? Several factors converge:
– Weak network segmentation and flat trust models create frictionless pathways for attackers.
– Overprivileged accounts and persistent administrative credentials allow quick privilege escalation.
– Legacy protocols and misconfigurations provide low-effort opportunities to pivot.
– Crimeware commoditization and ransomware-as-a-service lower the skill threshold for rapid intrusions.
– Automation and reusable playbooks turn human-driven steps into scripted, machine-fast operations.
These dynamics convert speed into a strategic advantage for attackers: strike fast, move laterally, exfiltrate or encrypt, then demand ransom or disappear before defenders can meaningfully intervene.
Operational implications for defenders
An 18-minute window drastically narrows the operational scope for incident response. Organizations that still rely on slow alerting pipelines, fragmented telemetry, or manual containment will likely be outpaced. The practical consequences include:
– Higher likelihood of core system compromise before containment.
– Increased success of ransomware and data-theft operations.
– Greater difficulty in attribution and forensic completeness as attackers complete actions quickly.
To push back, technologists point to two broad pillars: prevent and respond faster. Preventive measures reduce the chance an attacker can pivot; rapid detection and automated response reduce the chance they can succeed once they try.
Practical steps to slow or stop lateral movement
No single control is a silver bullet. Effective defense requires layered measures that assume an attacker will get in and prepare to limit their window and reach:
– Enforce least privilege: eliminate standing high-privilege accounts and adopt just-in-time access models to minimize the blast radius of credential compromise.
– Harden authentication: deploy multi-factor authentication everywhere practical and run ongoing credential hygiene programs to detect and remediate exposed secrets.
– Network segmentation and microsegmentation: segmenting east-west traffic introduces friction and forces attackers to overcome additional controls to reach critical assets.
– Telemetry fusion and automation: integrate endpoint, network, and identity telemetry into an XDR or SIEM with automated containment playbooks to act in minutes, not hours.
– Harden systems and patch promptly: reduce the number of exploitable vectors that enable rapid escalation.
– Adopt behavioral analytics: detect anomalous lateral movement patterns (unusual credential use, rapid remote execution) rather than relying solely on signature-based detection.
Trade-offs and organizational realities
Tighter controls inevitably introduce user friction and require cultural change. Automation brings the risk of false positives and demands careful tuning. Investment in modern detection and response capabilities takes budget and integration work many organizations find challenging. Yet the alternative — relying on time that no longer exists — is a worse bet. Security teams must accept that speed now favors adversaries and adapt accordingly.
Policy and governance implications
The compression of attacker timelines has consequences beyond individual organizations. Regulators and policymakers may need to revisit incident reporting timelines, guidance for critical infrastructure, and incentives for adopting zero-trust architectures. Agencies that already advocate segmentation and identity controls might accelerate guidance, funding, or mandates to ensure high-risk sectors have the capacity for rapid detection and response.
Business leaders and boards must also take notice. Faster lateral movement amplifies the operational risk of relatively small lapses — a reused password, a misconfigured cloud permission, or an unpatched service can enable near-immediate escalation. Cybersecurity is no longer a solely technical concern; it is an enterprise risk that requires board-level visibility, investment in resilient architecture, and rehearsed incident playbooks.
Conclusion: assume speed and design for containment
ReliaQuest’s finding that attacker breakout time has fallen to 18 minutes is more than a statistic — it’s a wake-up call. Organizations must assume an intruder will attempt rapid lateral movement and design people, processes, and technology to prevent, detect, and contain within that compressed window. Strengthening identity hygiene, segmentation, and automated response capabilities won’t be painless or cheap, but they are essential to tilt the balance back to defenders in an era where speed increasingly favors the adversary.
