Published research places the 2026 benchmark for adversary breakout time — the interval from initial foothold to active exfiltration — at around 72 minutes, described as a fourfold reduction on prior-year averages.
Treat the precise figure with the caution any vendor benchmark deserves. The direction is what matters, and it invalidates an assumption embedded in a great many response processes.
What 72 Minutes Excludes
Consider what typically happens in the first 72 minutes after a detection fires in a mid-sized organisation. The alert queues. An analyst picks it up. They check whether it is a known false positive. They look for a second signal. They decide whether to escalate. If it is outside working hours, some of that waits.
On this timeline, the human triage step has already been overtaken before it concludes. That is not a criticism of the analyst; it is an argument that any control depending on a person deciding is now positioned after the event it was meant to prevent.
The Uncomfortable Implication
The honest conclusion is that containment at this speed has to be automatic, and automatic containment means accepting that some legitimate activity will be interrupted by a machine with no judgement.
Most organisations have decided that trade is unacceptable, usually after one bad automated action. The arithmetic behind that decision changes when the alternative is an intruder finishing the job during triage.
It also raises the value of controls that do not require detection at all — short-lived credentials, egress restrictions, and permission scoping — because they bound the outcome without anyone having to notice in time.
This is an analysis file built on published research, listed below. Benchmark figures are vendor-derived and methodology varies; we treat the trend as the finding rather than the number. Corrections: corrections@forensicpost.com.