Kevin Beaumont on Nostr: Dwell time - the time between initial access to incident response (ie notification or ...

Dwell time - the time between initial access to incident response (ie notification or detection) rose slightly YoY. Attackers typically in environment for 11 days.

Do not believe the headlines around ‘ransomware deployed in 1 hour using AI!!!1!’ - every single incident response org data shows you usually have a week for detection and response before ransomware deployment. You can detect and respond - do it, don’t buy the magic cyber beans.