Security News > 2023 > August > Ransomware dwell time hits new low

Median attacker dwell time-the time from when an attack starts to when it's detected-shrunk from 10 to eight days for all attacks, and to five days for ransomware attacks during the first half of 2023, according to Sophos.

The dwell time for ransomware attacks also declined.

They were the most prevalent type of attack in the incident response cases analyzed, accounting for 69% of investigated cases, and the median dwell time for these attacks was just five days.

The number of attacks detected increased as the week progressed, most notably when examining ransomware attacks.

"In some ways we've been victims of our own success. As adoption of technologies like XDR and services such as MDR grows, so does our ability to detect attacks sooner. Lowering detection times leads to a faster response, which translates to a shorter operating window for attackers. At the same time, criminals have been honing their playbooks, especially the experienced and well-resourced ransomware affiliates, who continue to speed up their noisy attacks in the face of improved defenses."

Attackers are still getting into our networks, and when time isn't pressing, they tend to linger.

News URL

https://www.helpnetsecurity.com/2023/08/25/ransomware-attack-dwell-time/