How fast do attackers move once they are inside?

Sometimes within an hour, sometimes over weeks. Groups that use automated tools and stolen administrator passwords can reach servers very quickly after the first foothold, while others wait, explore and copy data before acting. Security vendors publish breakout time measurements, but those describe their own customers and methods, so treat any single figure with caution. The practical conclusion is the same in every case: assume you may have little time after the first sign. Decide in advance who can isolate a host at night, make sure alerts reach a person who reads them, and keep segmentation between workstations and servers so that the attacker's path is longer. NetSenX flags the steps that usually follow the foothold, beaconing, scanning and lateral movement, on every plan, and that is where the time to react comes from.

← All 69 questions on Attack techniques explainedAll topics