Attackers who get a foothold in a corporate network now start moving to other systems in about 18 minutes on average. That figure comes from ReliaQuest’s threat research covering June through August 2025, which measured “breakout time,” the interval between initial access and the first lateral movement. The fastest case it recorded, an Akira ransomware intrusion through a vulnerable SonicWall VPN, took six minutes.
Eighteen minutes is less time than many organizations take to acknowledge an alert, let alone investigate it. Once an intruder has moved beyond the first machine, containment gets much harder and the chance of reaching domain controllers, backups and sensitive data rises sharply. This article explains how attackers move so quickly, why some of their techniques sidestep endpoint tools altogether, and how defenders can close the speed gap.
How attackers move so fast
They arrive with credentials. Phishing, infostealer malware and credential stuffing give attackers valid logins before they ever touch the network, often for VPNs and remote-access portals. Valid credentials mean no exploit to trigger alarms, and logins from widely distributed infrastructure blend in with a remote workforce. We cover the credential market in Credential and identity theft is reaching crisis levels.
They get in through the browser. ReliaQuest found drive-by compromise was the most common initial access technique in the period, at 34% of incidents, driven largely by the Oyster malware campaign’s use of malicious ads and poisoned search results that deliver fake installers for popular IT tools.
They use the network’s own protocols. Remote Desktop Protocol, SMB file sharing and built-in administration tools let attackers move between machines using the same methods as legitimate administrators, a practice known as living off the land. ReliaQuest reported that ransomware operations encrypting data remotely over SMB rose to 29% of cases. In that approach, the attacker uses one compromised host to encrypt files on shared drives across the network, so the ransomware never runs on the servers holding the data and endpoint tools on those servers see little to stop.
They go straight for the systems that matter. Once they can move, attackers head for the same short list every time: domain controllers, which hand them control of every account; backup servers and consoles, which they delete or encrypt so recovery becomes impossible; and SaaS connectors and identity synchronization services, which extend their reach into cloud applications. Knowing that list is an advantage for defenders, because it tells you where monitoring, extra authentication and tamper protection will pay off most.
The hardware blind spot: IP-KVMs
An IP-KVM is a small device that connects to a computer’s keyboard, video and mouse ports and makes them available over the network. Administrators use them legitimately to manage servers remotely, even when the operating system is not running. Attackers value them for the same reason: control happens outside the operating system, leaving little or no software footprint for EDR to detect.
ReliaQuest said that in 56.7% of the IP-KVM cases it detected, the devices were linked to North Korean operatives. This connects to a pattern the US Department of Justice has prosecuted repeatedly: North Korean IT workers who obtain remote jobs at Western companies under false identities, with company-issued laptops shipped to “laptop farms” in the United States where facilitators attach IP-KVMs so the workers can operate them from abroad. The same hardware can reboot servers, install backdoors or copy data without generating the telemetry security teams rely on.
Closing the speed gap
No team of humans can reliably triage, investigate and contain an intrusion in 18 minutes around the clock. The goal is to make the first steps automatic and make lateral movement harder. In priority order:
- Automate initial containment. Configure EDR and security orchestration (SOAR) to isolate a host or disable an account automatically on high-confidence detections, such as credential dumping or ransomware behavior. Humans then review, rather than initiate, the first response.
- Harden identity. Require phishing-resistant MFA on VPNs, remote access and all privileged accounts. Monitor in real time for password resets, MFA changes and privilege escalations, which often precede lateral movement.
- Restrict lateral movement paths. Block workstation-to-workstation SMB and RDP with host firewalls, limit administrative protocols to dedicated management hosts, and use separate admin accounts that cannot log in to ordinary endpoints.
- Look beyond the endpoint. Add network traffic analytics to spot unusual SMB activity, such as one host writing to many file shares at once, and monitor identity provider logs for impossible travel and new device registrations.
- Deploy deception. Honeytokens, such as fake credentials and decoy file shares, generate high-fidelity alerts because no legitimate user should touch them, and they can slow attackers down.
- Audit hardware. Physically inspect server rooms and remote workers’ company devices where feasible, watch the network for unknown device types and IP-KVM management interfaces, and verify the identity of remote hires carefully.
- Patch edge devices fast. The six-minute Akira case began with a known SonicWall vulnerability, CVE-2024-40766. VPNs and firewalls on CISA’s Known Exploited Vulnerabilities catalog should be patched in days.
The trade-offs of speed
Automated containment can occasionally isolate a legitimate machine or lock out a real user. That risk is manageable: start with the highest-confidence detections, exclude a short list of critical systems that require human approval, and measure false positives. The alternative, waiting for a human to act, has a known cost at current attack speeds.
For many small and mid-sized organizations, the practical answer is a managed detection and response provider with authority to contain threats around the clock. Whichever model you choose, measure your own mean time to contain and compare it honestly with the attacker’s 18 minutes. Our guide to SentinelOne best practices covers how to configure automated response on one common platform, and our cybersecurity and compliance services can help design the playbooks.
Frequently asked questions
What exactly is breakout time?
It is the time from an attacker’s initial access to their first move onto another system. It matters because containing a single compromised machine is far easier than cleaning up after an attacker has spread.
Does EDR stop these attacks?
EDR is essential, but remote SMB encryption, valid-credential logins, unmanaged devices and IP-KVMs can all sidestep it. Combine it with identity monitoring, network analytics and segmentation.
How can we tell if an IP-KVM is on our network?
Look for unfamiliar devices in network access control and DHCP logs, known IP-KVM web interfaces on internal scans, and unexpected display or USB devices reported by endpoint inventory. Physical inspection remains the most reliable check.
Getting ahead of the clock
Delana Technologies helps organizations measure and cut their response times with automated containment, identity hardening and network segmentation. For a wider view of how AI is accelerating attacks, see AI-powered threats. To test your readiness, call 239.414.5126 or contact us.
Sources: ReliaQuest, “What’s Trending: Top Cyber Attacker Techniques, June–August 2025”; Infosecurity Magazine coverage of the report (September 2025); US Department of Justice announcements on North Korean IT worker schemes and laptop farms (2024–2025); CISA Known Exploited Vulnerabilities catalog entry for CVE-2024-40766.