How long do attackers stay before they are found?

Mandiant reports a global median of 14 days between compromise and detection in 2025, and 122 days for espionage and North Korean IT-worker cases.

Who usually finds the intrusion?

In 2025 organisations detected malicious activity themselves in 52% of Mandiant cases, up from 43%. The rest were told by outsiders such as customers, partners or the attackers.

News · Academy · November 12, 2026

Academy: how to know you are already compromised

Intruders now stay a median of 14 days before anyone notices. Eight checks a company can run this week, and what to do if one of them hits.

DRIVE 369 DAO · 3 min read

Academy, organisations, lesson 1. Most breaches are not announced. The first sign is often a customer's email, a strange bill or a message from the attacker. This lesson is about noticing sooner.

The facts that set the stakes

Mandiant's M-Trends 2026 (Google Cloud) reports a global median dwell time of 14 days in 2025, up from 11, and 122 days for espionage and North Korean IT-worker cases. Organisations spotted the intrusion themselves in 52% of cases (43% a year earlier). The median hand-off from the first intruder to a second group, such as a ransomware crew, was 22 seconds. Exploits were the top way in (32%), followed by voice phishing (11%) and previously stolen access (10%).

Eight checks to run this week

List your privileged accounts, including vendor and service accounts. The UK's NCSC advises to inventory them, learn each one's normal source addresses, working hours and systems, and flag deviations (NCSC).
Look for sign-ins that do not fit: a new country, odd hours, a service account used interactively.
List new accounts, OAuth apps and API keys created in the last 30 days. Remove what nobody can explain. Attackers add their own door.
Check that logging is still on. Turned-off or cleared logs are a sign in themselves.
Search web servers for files that should not exist. Unfamiliar scripts in upload and plugin folders, created recently, are the classic web shell. A web worker starting a shell, curl or wget is a red flag.
Review outbound traffic. A server that never called out and suddenly does, or a large transfer at night, is worth an hour.
Look for persistence: new scheduled tasks or cron jobs, new SSH keys in the authorised-keys file, new services.
Set tripwires. A decoy file or key that nobody has a reason to touch, and an alert when it is used, turns "we might notice" into "we will know". It costs almost nothing.

Items 3 to 8 are a practical checklist built from the sources in this series and from incident-response practice, not a single official list. NCSC calls repeated, human-led threat hunting a core detection function: it should go beyond known indicators and feed what it learns into automatic alerts.

If a check hits

Do not delete anything yet. Preserve logs, disk images and backups.
Move to the first 24 hours plan.
Reset the credentials involved from a clean machine, not from the one you suspect.
Treat everything the server could read as exposed, including keys in configuration files.

How Ghostdrive approaches it

Detection needs visibility. In Ghostdrive, every opening of your vault is written to an access journal that syncs between your devices, and another device opening it triggers an alert with a "Not me" path. The honest limit is that a client changed by an attacker could leave no entry, so it catches the ordinary case, not every one. Details.

Academy: start here · How often are we attacked?

Questions

How long do attackers stay before they are found?: Mandiant reports a global median of 14 days between compromise and detection in 2025, and 122 days for espionage and North Korean IT-worker cases.
Who usually finds the intrusion?: In 2025 organisations detected malicious activity themselves in 52% of Mandiant cases, up from 43%. The rest were told by outsiders such as customers, partners or the attackers.