According to the cyberthreat landscape M-Trends report from cybersecurity firm Mandiant, the median global dwell time  – the time between the initial cyber-attack and when the victim detects the intrusion – for a cyber-attack stands at 16 days. 

This is a significant drop from the 21-day median dwell time the report found in 2022. While 16 days is a marginal improvement, it still gives the attackers significant time to do damage. Dwell time stops when the attack is detected, it may sometimes take months or years to remedy the attack completely. 

The report recommends asking your chief information security officer four questions in light of improving cyber attack detection: 

• How do we measure our detection and response time, and what is our median time from detection to response and remediation? 
• Are we prepared to detect and respond to the most common malware, exploits, and initial infection vectors such as phishing? 
• What is our protocol when we are notified by a third-party that we are potentially compromised? 
• How are we positioned to ensure exploit mitigation for systems with known vulnerabilities? 

The drop in detection time can largely be attributed to an increase in law enforcement efforts on cybercrime, such as the global coordinated takedown of Genesis Marketplace earlier this month. 

The report found that attacks are being detected faster in the Americas and Europe, Middle East, and Africa (EMEA) than they are in the Asia-Pacific (APAC) region. The Attackers leverage various kinds of attacks depending on the location of the victim. Exploits were the most successful in the Americas, phishing in EMEA, and prior compromises in the APAC. 

Recommended

• Gartner: Top 10 Government Tech Trends
• University of Edinburgh AI Accelerator Applications Open
• Edinburgh on the Rise as European Data Capital

Another factor in the decrease is a drop in attacks overall is the war in Ukraine according to the report. Some cyber-criminal infrastructure was affected by the mobilisation and instability in Russia and Ukraine, as well as global efforts of cybercrime being redirected towards the war efforts. 

The report pointed out the overlap of kinetic warfare with cyber attacks as “the new de facto standard.” According to the report, more cyber attacks on Ukraine had happened in the first four months of 2022 than in the previous eight years.