Breakout time: how long defenders have

#The numbers

Averages hide the tail that matters: a defender built for the average loses to the fastest third of intrusions.

#Measuring your own

Vendor averages describe adversaries across thousands of intrusions. Your own number is more useful: for every confirmed intrusion or red-team exercise, record the time of initial access, first lateral movement, first detection and containment. The gap between first lateral movement and first detection tells you how often you lose the race. Red-team exercises are the safest source of this data, which is one reason to run them with the SOC unannounced.

#Turning breakout time into targets

The budget for detection, investigation and containment must fit inside breakout time:

$t_{\text{detect}}+t_{\text{queue}}+t_{\text{investigate}}+t_{\text{contain}}<t_{\text{breakout}}$

The term people forget is $t_{\text{queue}}$: the time an alert waits before anyone opens it. In our queueing model, a SOC at 91% utilization with realistic investigation-time variance left 14% of alerts waiting over 30 minutes before triage even started. Automated investigation and pre-approved containment are how the sum fits inside an hour — or a minute.

#Sources

1. [1] CrowdStrike, “CrowdStrike 2025 Global Threat Report” findings