The 22-second handoff figure from M-Trends 2026 is the one getting amplified across LinkedIn and security briefings. It is striking: Mandiant reports that in 2025, the median time between a threat actor gaining initial access and passing that access off to a secondary group collapsed from over eight hours (in 2022) to 22 seconds. The implication feels obvious — detection windows have disappeared, response is impossible, your SOC is irrelevant.
That reading is wrong, and it’s worth slowing down to understand what the figure actually means and what the rest of the report tells you that the headline doesn’t.
What 22 Seconds Actually Measures
The handoff time measures the gap between initial access and the pre-staging of secondary malware during the same infection chain. This isn’t two separate groups making coordinated decisions in real time. It’s an automated process: the initial access malware pre-loads the secondary payload, which executes almost immediately, because both the initial access broker and the downstream ransomware operator are working from pre-negotiated automation.
The implication isn’t that defenders can’t detect fast enough. It’s that the economic specialisation of the criminal ecosystem has matured to the point where access brokers and ransomware operators have integrated their operational pipelines. Detection of the initial compromise remains the critical intervention point. If you catch the initial loader, you catch the ransomware deployment. The 22-second window tells you not that detection is futile, but that the attacker is treating initial access as a commodity handoff rather than an operation requiring separate coordination.
Dwell Time Went Up, Not Down
The headline speed statistic sits alongside a finding that moves in the opposite direction: global median dwell time increased from 11 days to 14 days in 2025. For cyber espionage operations and North Korean IT worker infiltrations, median dwell time was 122 days. BRICKSTORM, a backdoor deployed against edge network devices by a China-nexus cluster, persisted for nearly 400 days in some environments before discovery.
These two facts coexist because there are two different types of intrusion happening simultaneously. Ransomware operations are fast and loud by design — encryption is the monetisation event, and it must happen before the victim recovers access. Espionage operations optimise for silence and persistence. Dwell time going up while attack handoff speed goes up reflects the bifurcation of the threat landscape, not a contradiction.
The dwell time increase is partly explained by a structural visibility gap. Mandiant’s investigation data identifies edge devices — VPNs, routers, network appliances — as the preferred persistence location for long-dwell actors. These devices typically lack endpoint detection and response agents, have minimal onboard storage that prevents forensic reconstruction, and are rarely included in SIEM log forwarding. Standard 90-day log retention windows mean that organisations are systematically blind to the initial access events for many espionage intrusions. UNC6201 and UNC5807, two China-nexus clusters identified in the report, deploy custom in-memory malware to these devices and exploit native packet-capture functionality to intercept credentials in transit — capabilities that are essentially invisible to conventional monitoring.
Exploitation Is Happening Before Patches Exist
Mean time to exploit (MTtE) reached -7 days in 2025. The negative figure means exploitation is occurring before the patch is released — either through zero-day exploitation or through attackers accessing vulnerability information through channels that precede public disclosure. Exploits remain the most common initial access vector for the sixth consecutive year, accounting for 32% of intrusions.
This isn’t a new finding but the acceleration is notable. It argues specifically against the posture where vulnerability management is treated as a matter of patch scheduling rather than continuous exposure reduction. Organisations that wait for patch Tuesday, assess the vulnerability against an internal severity matrix, and schedule deployment over weeks are operating on a timeline that doesn’t reflect how quickly exploitation occurs. The practical implication is that internet-facing assets need continuous exposure monitoring and that critical patches for perimeter devices need deployment windows measured in hours, not days.
Vishing as the Second Vector
Voice phishing became the second most common initial access vector in 2025, accounting for 11% of intrusions. This deserves more attention than it typically receives in technical security discussions.
Vishing in this context isn’t unsophisticated. Mandiant’s investigations document threat actors calling IT help desks to social-engineer MFA bypass, impersonating employees to harvest SaaS credentials, and targeting third-party vendors as pivot points into enterprise environments. The objective is typically to obtain OAuth tokens or session cookies that persist beyond MFA authentication events — long-lived credentials that allow access to Microsoft 365, Salesforce, or other SaaS platforms without requiring repeated authentication.
UNC3944 (Scattered Spider) and related groups pioneered these techniques against telecommunications and financial services targets. The M-Trends data confirms that the playbook has now diffused widely. The technical controls that defend against phishing — email filtering, link analysis, attachment sandboxing — don’t address a phone call to a help desk employee. Defence against vishing-based initial access is procedural: strict callback verification, out-of-band identity confirmation for MFA resets, and aggressive restriction of what help desk agents can do without cryptographic authentication.
Prior Compromise Is Now the Leading Ransomware Vector
For ransomware specifically, prior compromise — access obtained from earlier, often undetected intrusions or purchased from initial access brokers — has become the number one initial access method, accounting for 30% of ransomware intrusions. This doubled from 15% in 2024.
The practical reading: ransomware victims frequently have had undetected access sold or retained from a previous incident. The question “why did they pick us?” increasingly has the answer “because someone compromised you three months ago and sold the access.” This creates an argument for continuous assessment of externally accessible credentials and endpoint telemetry specifically designed to catch low-and-slow initial access patterns that haven’t escalated yet.
Hypervisors as the Ransomware Target
M-Trends 2026 documents a specific escalation in ransomware operator technique: targeting the hypervisor management plane rather than individual endpoints. By encrypting hypervisor datastores directly — using groups like REDBIKE (the Akira-associated tooling) and AGENDA (Qilin) — attackers render all virtual machines inoperable simultaneously rather than needing to encrypt each one individually.
This is why recovery isolation matters at the infrastructure layer, not just the data layer. Ransomware groups are also systematically targeting backup infrastructure, destroying identity services, and exploiting misconfigured Active Directory Certificate Services templates to create persistent administrative accounts that survive recovery attempts. Backups that are joined to the corporate Active Directory and reachable from the same network plane as production systems are not an effective recovery mechanism against an attacker who has domain administrator access.
What the Report’s Own Uncertainty Implies
One finding in M-Trends 2026 that doesn’t get discussed enough: internal detection rates improved from 43% to 52%. This is the fraction of breaches where the victim’s own security team identified the intrusion rather than being notified by law enforcement, a security vendor, or the attacker themselves.
Progress from 43% to 52% matters. But it means 48% of breach victims still find out from an external source. In many cases, that external source is the attacker notifying them via a ransom note. The report that documents attacker speed going to 22 seconds also documents that nearly half of organisations aren’t detecting their own intrusions.
The implication isn’t that the tools don’t work. It’s that detection capability is unevenly distributed and that the organisations most vulnerable to long-dwell espionage operations are precisely those with the largest gaps in telemetry coverage: edge devices, hypervisors, and SaaS platforms where conventional endpoint agents don’t apply. Extending visibility to those surfaces — and extending log retention past 90 days — is the infrastructure investment that M-Trends 2026 implicitly argues for, whether or not it says so directly.