# How much time passes between first access and encryption?

It varies too much for one number to be useful: from hours, when an automated group exploits an exposed system, to weeks, when access is bought from someone else or the attackers take their time to find backups and copy data. What is consistent is the sequence: access, contact with the attacker's server, discovery, movement to servers, data theft, and only then encryption. Each stage is a chance to notice. Plan as if you have little time: keep backups offline so they survive, make sure remote access requires multi-factor authentication (MFA), and decide in advance who isolates a host at night. Treat any sign of the early stages, such as a workstation scanning internal ranges, as urgent. NetSenX alerts on the network behaviour of those stages on every plan, and that is where the time to act comes from.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/how-much-time-between-first-access-and-encryption

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How can ransomware spread through a USB stick or external drive?](https://netsenx.com/en/faq/how-can-ransomware-spread-through-a-usb-device)
- [What evidence should we keep for the insurer, the police and the regulator?](https://netsenx.com/en/faq/what-evidence-to-keep-for-insurer-police-and-regulator)
- [How long does NetSenX keep the network evidence of an incident?](https://netsenx.com/en/faq/how-long-does-netsenx-keep-incident-evidence)
- [Should we hire an incident-response firm or handle an incident ourselves?](https://netsenx.com/en/faq/should-we-hire-an-incident-response-firm-or-handle-it-ourselves)
- [How do we tell customers what data was affected in a breach?](https://netsenx.com/en/faq/how-to-tell-customers-what-data-was-affected)