Internal security teams at enterprise organizations are generally getting better at detecting compromises, but it’s still taking them well over a month to discover them.
A FireEye analysis of global breach data from 2018 shows that half of all organizations last year took 50.5 days or longer to detect an intrusion after it first began. That was one week faster than the median of 57.5 days it took them in 2017.
However, when organizations first learned of an intrusion from law enforcement or another source, it was typically only after the attackers had already been on their networks for 184 days, or more than six months. That number was almost unchanged from the 186 days recorded in 2017.
