An on-call analyst gets paged, opens the console, and reaches the part of the runbook that involves other people: a bridge line, an approval to disable a service account, a call to whoever owns the affected system. In nearly one in five of the cases Unit 42 worked in 2024, the data had already left inside the first hour of compromise [4]. Every one of those steps has to fit inside that window, or it is documentation rather than response.
Multiply it out. Unit 42 responded to more than 500 major attacks last year [1], so nearly one in five puts roughly 100 engagements in the group where exfiltration beat the first status update [12]. The other four fifths left more room. That split, not the headline percentage, is the thing a detection budget is actually being asked to choose between.
What teams tell themselves is that faster alerting buys down the whole curve. The report's own diagnosis is duller than that: it names complexity, gaps in visibility and excessive trust as the three enablers, with fragmented architectures, unmanaged assets and overly permissive accounts as the space attackers work in [9]. Seventy percent of the incidents ran on three or more fronts [6] and 86 percent produced business disruption [3]; if both shares come from the same set of engagements, at least 56 percent did both, since 86 plus 70 minus 100 leaves 56 [13]. A plan that treats endpoint, cloud and identity as separate queues with separate owners is being asked to work in the case where all of them are live at once. Forty-four percent of the incidents involved a web browser, including phishing and malware downloads [7], while one campaign scanned more than 230 million unique targets looking for sensitive data [8]. The funnel in front of you is automated and wide; the door is often a tab somebody in finance has open.
Read the denominator before this goes into a budget meeting. Palo Alto Networks is publishing its own responders' casework [14]: over 500 major attacks at large organizations dealing with extortion, network intrusions, data theft and advanced persistent threats [16], across 38 countries [2]. Firms enter that set because they already needed outside help, which makes it a good measure of how bad days go and a poor one of how often they arrive. The fifth trend, AI-assisted attacks, is offered as early observations with no figure attached at all [11], which is precisely the one most likely to survive into a slide. The remedies read as direction rather than a bill of materials: Zero Trust, securing applications and cloud from development to runtime, consolidated logs across on-premises, cloud and endpoint, and automation-driven detection and remediation [10].
The usable version is a table. For each of your three most exfiltration-worthy data stores, sort every control that would stop the theft into one of three columns: already on, fires without a human, needs a human to approve. Anything in the third column is out of play for the fast fifth. Then name which slice you are buying down, because cutting mean time to detect from days to hours does nothing for a 60-minute exfiltration, and pre-authorising containment that fires on its own is a governance argument with a security budget attached to it.
