M-Trends 2024 Special Report

Dwell time is the number of days an attacker is on a system from compromise to detection, and in 2023 the global median dwell time is 10 days, down from 16 days in 2022.

For ransomware cases, the global median dwell time is 5 days compared to 9 days in the previous year.

54% of organizations first learned of a compromise from an external source, while 46% first identified evidence of a compromise internally. 63% of notifications were external in 2022, suggesting organizations are improving at detecting malicious behavior.

In 70% of ransomware cases, organizations learned of intrusions from external sources. Of those external sources, 76% were adversary notifications and 24% were external partners.

We most frequently responded to intrusions at financial services organizations (17.3%), business and professional services (13.3%), high tech (12.4%), retail and hospitality (8.6%), healthcare (8.1%), and government (8.1%). Organizations in these industries have access to a variety of sensitive data that is attractive to attackers.

The most common initial infection vectors were exploits (38%), phishing (17%), prior compromise (15%), and stolen credentials (10%). These numbers are relatively consistent with what organizations faced in 2022.