An attacker who gets into a business network now needs about 29 minutes to spread from the first machine to the rest of it. The average organization takes six days to respond. Those two numbers come from the CrowdStrike 2026 Global Threat Report, and they explain more about why small businesses lose to ransomware and wire fraud than any diagram of a firewall ever will. This guide is for the Charlotte owner who has a good IT provider, gets a ticket answered by lunchtime, and assumes that is enough. It is not, and the reason is arithmetic.
The numbers, and where they come from
- 29 minutes. The average “breakout time” in 2025: the gap between an intruder’s first foothold and their move to a second system. It was 65 percent faster than the year before.
- 27 seconds. The fastest breakout recorded.
- Six days. The average time an organization takes to respond to an intrusion.
- 82 percent. The share of detections in 2025 that involved no malware at all. The intruder logged in with a real password, or used tools already on the machine.
These are one vendor’s figures, measured across its own customers, so treat them as a strong signal rather than a census. Every other major report points the same direction. The FBI’s Internet Crime Complaint Center has ranked business email compromise, an attack with no malware in it, among the costliest crime types for years.
Why six days is the number that decides the outcome
Picture a 30-person Charlotte firm at 6:40 on a Tuesday evening. An employee’s Microsoft 365 password, stolen in a phishing email last week, is used from a browser in another country. By 7:10 the intruder has read the shared mailboxes, found the invoice templates, and set a rule that forwards anything with “payment” in the subject to an outside address. By 7:30 they have tried the same password on the file server and it worked. Nothing has crashed. No antivirus fired, because nothing malicious was installed. The first human sign is a client asking on Thursday why the bank details on an invoice changed.
Every stage of that story happened inside the 29-minute window. The help desk was closed. Even if it had been open, nobody had opened a ticket, because nothing looked broken. A provider whose model is “you call us, we fix it” is structurally five and a half days late to this attack, however good the engineers are.
What actually closes the gap
Closing a six-day gap to under an hour is not about working faster. It is about three things that run without a person deciding to start them.
- Something watching the sign-ins, not just the machines. Because 82 percent of intrusions carry no malware, the signal is behaviour: a login from a new country, a new mailbox forwarding rule, a first-time connection between two servers. That is the job of 24/7 monitoring feeding a security operations center that can act at 7 p.m., not read about it at 8 a.m.
- Containment that does not wait for approval. Managed detection and response on every endpoint can isolate the first machine and disable the account within minutes of the alert. That is the difference between one compromised laptop and a company-wide incident. Our EDR guide explains what that looks like day to day.
- Fewer doors to break out through. Phishing-resistant multi-factor authentication and least-privilege access mean the stolen password does not open the file server, and the intruder’s 29 minutes produce nothing. MFA and least privilege are the cheapest controls on this list and the ones most often missing.
Three questions for your current provider
- If an employee’s password is used from another country at 7 p.m., who finds out, and when? The honest answer for many providers is “nobody, until someone reports a problem.”
- Who is allowed to isolate a machine or disable an account without calling you first? If the answer is nobody, containment waits for a phone call.
- How many of my users can sign in without multi-factor authentication? Ask for the list, not the policy.
Clear answers mean your provider has already solved this. Vague ones mean the six-day number is yours.
Where Network Essentials stands
Network Essentials has been independently owned in Charlotte since 2002 and is CISSP-led. Our clients’ sign-ins, mailboxes and devices are monitored around the clock by a managed security operations center with authority to contain a threat without waiting for a call. Routine patches go out weekly and critical ones immediately, backups are immutable and restore-tested, and clients have after-hours emergency support when something real happens. Engagements are a flat monthly fee with a minimum of $2,000 per month. Agreements are month-to-month from day one, with no annual contract. You can cancel with 30 days’ written notice, for any reason, with no termination fee. Call (704) 206-8900 or request a free IT audit, and we will tell you where your own gap is.
For a picture of the attack volume behind those numbers, see what a live cyber attack map does and does not tell a Charlotte business owner.
Cutting response time from days to minutes is the job of a managed SOC. For manufacturers, where a stopped line is the cost, see IT support for Charlotte manufacturers.
Frequently asked questions
What is breakout time?
The time between an attacker’s first access to one system and their move to a second one inside the same network. CrowdStrike measured an average of 29 minutes in 2025, with a fastest case of 27 seconds.
Why does antivirus not catch these attacks?
Because 82 percent of intrusions in 2025 used no malware. The attacker signed in with a stolen password or used tools already on the computer. Antivirus looks for malicious files; catching these requires watching behaviour, such as unusual sign-ins and new mailbox rules.
Does a small business really need 24/7 monitoring?
If money moves through its email, yes. The attacks that cost small businesses the most start outside business hours and complete in under an hour. A help desk that opens at 8 a.m. cannot respond inside that window.
What can we do this week without buying anything?
Get the list of users without multi-factor authentication and fix it, check every mailbox for forwarding rules you did not create, and ask your provider the three questions above.
