Mandiant's M-Trends 2026: Ransomware Breakout Time Just Hit 22 Seconds, and Your IR Plan Wasn't Built for That

The 22-second figure describes a specific, narrow phase of the ransomware attack chain: the interval between an initial access broker establishing a foothold in an environment and that broker handing operational control to a ransomware affiliate group. Mandiant reports this median fell to 22 seconds in 2025, compared with more than eight hours in 2022. That is not a claim that every ransomware attack fully compromises an environment in 22 seconds. It is a claim about how fast the access-broker marketplace has industrialized: initial access is now bought, sold, and transferred between criminal groups on a timeline that in some cases barely allows a defender's alert to finish generating before the buyer is already acting on it.

The dwell time figure measures something different: across Mandiant's full 2025 caseload, the median time between initial compromise and detection, regardless of intrusion type, was 14 days, up from 11 days in 2024. Mandiant attributes a meaningful share of that increase to a specific subset of the dataset. Cyber espionage intrusions and North Korean IT worker operations, both categories with a strong incentive to stay hidden rather than move fast, had a median dwell time of 122 days, roughly four months, according to the report. When a subset of long-dwell, stealth-oriented intrusions grows as a share of the total caseload, it pulls the overall median upward even while the fastest-moving intrusions in the same dataset keep getting faster. Both trends are real, and both come from the same 2025 caseload; they are just describing opposite ends of the same distribution.

It would be easy to write two separate stories here, a speed story and a stealth story, and treat them as unrelated. The more useful read is that M-Trends 2026 describes a bimodal threat landscape, and a defender's response posture has to account for both ends at once rather than optimizing for one.

At one end, financially motivated eCrime operators, especially ransomware affiliates buying access from brokers, have compressed their operational timeline to the point where the handoff itself, historically a coordination step that took hours, now sometimes takes under a minute. Mandiant's report also documents concrete case examples of how little time elapses once that access changes hands. In one incident it describes, roughly 70 minutes passed between a FAKEUPDATES malware infection and the buying group's first interactive activity, including backup destruction ahead of ransomware deployment. At the other end, espionage actors and North Korean IT worker operations are optimizing for the opposite thing: staying undetected for months while they pursue long-horizon objectives like sustained access, data collection, or fraudulent employment schemes.

A containment SLA or IR plan calibrated only to the historical average, whatever number an organization has been using, misses both extremes. It is too slow for the affiliate who has already moved to encryption before the SLA clock even starts, and it offers false comfort against the espionage actor who is specifically built to survive well past any reasonable detection SLA. The practical implication is that a single containment target number cannot describe the range Mandiant's own data shows.

Most incident response plans, and the containment SLAs written into them, were built around an assumption that no longer holds for a meaningful slice of ransomware incidents: that there is a window, usually measured in hours, between initial detection and full compromise, during which a human analyst can triage, escalate, and act. Several concrete plan elements depend on that assumption and break when it does not hold.

• Time-to-contain SLAs. A containment SLA of "contain within 4 hours of detection" assumes detection happens before or alongside the attacker's escalation, not after full compromise is already complete. When handoff and follow-on activity can occur in under a minute to just over an hour, a four-hour SLA is not a stretch target, it is irrelevant for that class of incident.
• Escalation chains that require human sign-off. Plans that route every containment action, network isolation, credential resets, EDR-driven process kills, through a human approver at each step add minutes of latency per step. Multiply that across a multi-step escalation tree and the plan's total reaction time can exceed the attacker's entire operational window.
• Tabletop scenarios built around a detection-to-response gap. Exercises that start the clock at "the SOC gets an alert" and walk through a multi-hour response timeline are rehearsing a scenario that a fast-handoff ransomware incident will never match, because by the time the alert is triaged the relevant window has already closed.
• Communication plans sized for a slow burn. Notification trees, executive briefings, and legal engagement steps built assuming a multi-day runway before real damage occurs do not hold up when destructive activity, including backup destruction, can start within roughly an hour of initial infection, per Mandiant's own case example above.

Our DFIR guide covers the baseline incident response lifecycle these plans are built on; the gap M-Trends 2026 surfaces is specifically in the containment and escalation steps of that lifecycle, not the forensic follow-up that happens afterward.

The only way to meaningfully close a sub-minute-to-sub-hour gap is to remove as many human decision points as possible from the earliest containment actions, at least for the highest-confidence detection signals. That means pre-authorizing automated response for a defined, narrow set of high-confidence triggers, such as an EDR agent automatically isolating a host on a confirmed ransomware-family process signature, or a SOAR playbook automatically disabling a credential the moment it is flagged in a confirmed access-broker listing, without waiting for analyst confirmation first.

This is a narrower ask than "automate the SOC." It specifically targets the small number of detection types where confidence is high enough that the cost of a false positive (a host taken offline unnecessarily for a few minutes) is clearly lower than the cost of a false negative (a ransomware affiliate given a multi-hour head start). Getting this right requires a deliberate, documented list of which signals qualify for automatic action versus which still route to a human, reviewed on a regular cadence as detection tooling and threat behavior change. Environments with meaningful cloud footprints face a version of this same problem with less mature native tooling; our cloud forensics and incident response guide covers what automated containment looks like when the compromised asset is a cloud workload rather than an on-premises endpoint.

Most tabletop exercises are still built around a timeline where the team has room to think between steps. A tabletop that assumes a multi-hour gap between detection and full compromise is rehearsing for last decade's ransomware timeline, not this one. A useful redesign adds at least one scenario per cycle where the injects compress dramatically: the facilitator reveals that full compromise, including backup destruction, happened within the first few minutes of the exercise, before the team's first planned decision point. The exercise then has to test whether the plan's automated containment controls (not the human escalation tree) actually would have acted in time, and whether the team's post-compromise response (communication, recovery, law enforcement engagement) still functions when it is triggered by an automated containment action rather than a human decision.

A specific, well-scoped example worth rehearsing is a supply chain or CI/CD compromise, where an attacker who gains access to a build pipeline can potentially reach production credentials and downstream systems faster than a traditional endpoint-based tabletop assumes. Our GitHub Actions supply chain incident response checklist is a useful basis for that specific scenario variant, since CI/CD compromise is one of the access paths where the time from initial foothold to broad blast radius can be extremely short.

Leadership conversations about containment SLAs are often framed as a single number: how fast can the team respond. M-Trends 2026 gives security leaders a specific, sourced reason to reframe that conversation into two separate SLAs rather than one, because the two ends of Mandiant's distribution require genuinely different capabilities and genuinely different budget asks.

The first SLA covers high-confidence, fast-moving threats, primarily commodity and affiliate-operated ransomware, where the target has to be measured in automated response latency (seconds to low minutes), not human response time, because Mandiant's own data shows the fastest cases in this category leave no meaningful human reaction window. Funding this SLA means investing in detection and response automation, not more headcount for the SOC's human triage queue.

The second SLA covers stealthy, long-horizon intrusions, espionage and North Korean IT worker operations chief among them in this report, where the honest target is measured in days to weeks of investigation depth, not minutes of reaction speed, because a 122-day median dwell time reflects an adversary actively designed to evade fast detection. Funding this SLA means investing in threat hunting maturity, log retention depth, and detection engineering aimed at subtle behavioral indicators, not faster alert routing.

Presenting these as one SLA to leadership invites an underfunded compromise that serves neither case well. Presenting them as two, each grounded in a specific number from a named, citable report, gives a CISO a much stronger basis for a budget conversation than an internal estimate would.

Two caveats matter here as much as the headline numbers do. First, Mandiant's caseload is not a random sample of every intrusion that happened globally in 2025. It reflects the specific incidents Mandiant was engaged to investigate, which skews toward organizations with the resources and awareness to bring in an external IR firm in the first place, and toward incident types Mandiant's own practice areas are most engaged in. That does not make the 22-second or 14-day figures wrong, but it means they describe Mandiant's caseload, not a universal constant that applies identically to every organization's actual threat mix.

Second, the 22-second figure specifically measures the initial-access-broker-to-affiliate handoff step, not the entire attack chain from first foothold to ransomware deployment or data exfiltration. Treating it as "ransomware fully compromises everything in 22 seconds" overstates what Mandiant reported. The honest reading is narrower and, if anything, more actionable: the coordination step between separate criminal groups, a step that used to create a real window for detection, has largely collapsed, which is exactly the kind of structural change worth redesigning a containment plan around, independent of whatever the exact number turns out to be in next year's report.