Incident response research reports that 52% of intrusions were detected internally in 2025, up from 43% the previous year, and that internal detection was associated with a nine-day median dwell time against a fourteen-day overall median.
The Alternative To Internal Detection Is Being Told
External notification means a law enforcement agency, a vendor, a partner, a researcher — or the attacker, via a ransom note or a leak-site listing.
The corpus is full of the last category. It filed at 25-1027 that Marquis detected on the day it happened and treated that as notable specifically because so many files record organisations learning from the outside.
Nine Against Fourteen Days Is The Finding
Not the 52%. The corpus filed at 25-1125 that the 102-day Nevada interval was where the outcome was decided, and that prevention will fail while detection determines whether a failed prevention becomes a statewide outage.
A five-day difference in median dwell, attributable to who noticed, is that argument quantified — and it is the strongest available case for spending on detection rather than on prevention.
And The Trend Line Matters More Than The Level
43% to 52% in one year is a nine-point improvement in a measure that describes organisational capability rather than adversary behaviour.
This desk has been sceptical of fast-moving percentages throughout — at 25-0423, 25-0821 and 25-1210b — on the grounds that a number moving faster than the world is measuring the instrument. Defensive capability is the one category where fast movement is plausible, because it follows product adoption rather than human behaviour.
Graded medium: one practice’s engagements, which over-represent organisations able to retain incident response.
Built on published incident response research, listed below. The population is the practice’s engagements and is not representative. Corrections: corrections@forensicpost.com.