Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Inside the Modern SOC: The 72-Minute Race

Summary: Unit 42's 2026 Global Incident Response Report found that in the fastest cases attackers moved from initial access to confirmed data exfiltration in 72 minutes, a 4X year-over-year acceleration as adversaries use AI to automate more of the attack lifecycle. The report attributes 65% of initial access to identity-based techniques, and Unit 42 says investigators reviewed evidence from two or more distinct sources in 87% of incidents, with complex cases drawing on as many as 10.

What you should know: A 72-minute path from login to exfiltration means manual triage is already too slow, and with 65% of entry points being identity-based, the compromised credential - not the malware - is the exposure to plan around.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026