The patch gap: When attackers move in hours and you patch monthly
Here is a number worth sitting with: The average cybercrime breakout time in 2025 was 29 minutes. That is the window between an attacker gaining initial access and beginning lateral movement to other systems, according to the CrowdStrike 2026 Global Threat Report. The fastest observed case in the dataset was 27 seconds. In one documented intrusion, data exfiltration began within four minutes of initial access.
Many incident response (IR) plans are not built for this speed. They assume a detection lag of days or weeks, a deliberate investigation phase, and an orderly escalation to containment. What the data describes is something different: an attacker who is already moving through your environment before most IR processes have even started.
What follows is a realistic timeline of what the first 60 minutes of your IR should look like, and where your organization may fall short.
Minutes 0 to 10: Detection and initial triage
The breach clock starts when the attacker gains access. Your clock starts when someone notices.
The gap between those two moments gives the attacker time to establish persistence, map the network, identify high-value targets, or steal data. Mandiant M-Trends 2026 measured a global median dwell time of 14 days in its 2025 investigations. The first alert your team sees may therefore reveal an attack already well underway.
When an alert fires, the first few minutes revolve around a single question: is this a real threat, and how bad is it? This phase breaks down in predictable ways. Alert fatigue can bury genuine detections in noise. Unclear escalation paths leave your first responder unsure whether to call your SOC lead or your CISO. Playbooks that have never been tested can leave the person holding the alert improvising.
The immediate task is to establish what triggered the alert, which system or account is involved, and whether there are signs of continuing harm. Active encryption, suspicious privileged access, or apparent data theft may warrant action before the full investigation is complete.
Solutions like Endpoint Central’s EDR Event Triage Agent can support this first pass by correlating endpoint telemetry and threat intelligence, prioritizing alerts, mapping observed activity to MITRE ATT&CK®, and recommending next steps. It gives your responders investigation context to review, with containment and remediation decisions remaining under their control.
Your responders also need defined severity criteria, a reachable on-call contact and a named person coordinating the incident. Someone should begin recording findings and actions immediately, so the next person joining the response does not have to reconstruct what has already happened.
Minutes 10 to 30: Escalation and scope assessment
If triage confirms a real incident, the next priority is to establish how far it reaches into your network while restricting the attacker’s ability to continue.
The 29-minute breakout figure does not mean your team has 29 minutes left. The clock starts at initial compromise, not detection. Lateral movement may already have occurred, which makes it important to investigate beyond the device that raised the first alert.
Your scope assessment needs to answer four questions fast:
Which systems are confirmed or suspected to be affected?
Which credentials or sessions may be compromised?
Is there active exfiltration or destructive activity underway?
Which critical services or sensitive data could be at risk?
The quality of those answers depends heavily on your logging and inventory infrastructure that existed before the incident. Having an accurate inventory helps you identify affected systems and their owners. Endpoint, identity, network, and cloud records help you establish what happened and where else to look. Gaps in those records can slow the investigation and leave parts of the scope uncertain.
Keep that uncertainty visible. A connection attempt does not prove that another system was compromised. The absence of an alert does not prove that it was unaffected.
Isolation is another critical action: your team must restrict network communication from affected endpoints while keeping them powered on where feasible to preserve volatile evidence. CISA’s ransomware guidance recommends isolating affected systems immediately, with shutdown as a fallback when disconnection is not possible and further spread must be stopped.
For compromised identities, your responders may need to disable accounts, revoke active sessions, and reset exposed credentials. Investigate and restrict related accounts where there is reason to suspect compromise. These are distinct actions, and their effect depends on your identity platform.
You should also define who has authority to isolate systems and restrict access before the incident happens. Your responders need to know what they can do immediately and when operational impact requires escalation. Discovering the approval process while an attacker is moving adds a delay your team could have avoided.
Minutes 30 to 60: Containment verification and evidence preservation
When your team takes a containment action, it does not establish that the incident is contained. That conclusion has to be earned.
Isolating a device can restrict its communication. It does not confirm that the attacker has not already moved to three others. Disabling an account does not confirm that active sessions have ended or that the attacker has not established a secondary foothold.
Containment verification requires answering specific questions:
Did the isolation action succeed?
Is there unexpected network traffic from affected systems?
Is compromised access still being used?
Is there evidence of related malicious activity on other systems?
EDR telemetry is an important source of evidence. Endpoint Central EDR provides visibility into process, file, and network activity to support your investigation. Your responders should combine that evidence with identity-provider logs, cloud audit records, and network telemetry as the incident requires. No single view should be treated as proof that every affected system has been found.
Evidence preservation runs in parallel and can get sacrificed under pressure. Your instinct may be to restore as fast as possible—but rebooting or rebuilding too soon can remove evidence you need to understand how the attacker got in, what they accessed, and whether they are still present elsewhere.
The evidence that matters may include memory captures before reboot where feasible, authentication logs showing which accounts were used and from where, network flow records, and endpoint telemetry showing process execution and lateral movement. Urgent isolation should not wait for a memory capture to finish.
Document the source, collection time, collector, and storage location of evidence. Follow your organization’s chain-of-custody procedures where applicable, and record response actions as well as attacker activity. Those records help distinguish changes made during the attack from changes made by your response team.
By the end of the hour, your team should be able to explain what has been contained, what remains uncertain, and what needs to happen next. That is a more useful measure of progress than the number of alerts closed.
What the timeline requires before the incident
Having a functional first-hour response assumes capabilities that you've built and tested in advance.
Continuous monitoring needs to be paired with alerting that reaches someone who can act. A useful detection loses value if it sits unattended or arrives without enough context to investigate. Monitoring coverage, accessible records, and clear ownership all influence how quickly your team can respond.
A tested playbook matters just as much. A plan your team has never exercised may contain gaps nobody discovers until they need it. Tabletop exercises can surface the escalation contact who left six months ago, the containment action nobody has permission to perform, or the communication process that depends on a compromised system.
Preparation should also cover how your team will communicate if its usual tools are unavailable or untrusted. Having an accessible contact list and an alternative response channel can prevent an incident from disrupting the coordination needed to contain it.
The first 60 minutes will not resolve every breach, but they should establish control over the response: a named lead, an initial scope, containment actions that have been checked, and evidence that supports the next decision.
The time you spent preparing makes those decisions easier when the pressure arrives. Your team should be investigating the attacker’s next move, not trying to discover your response process.