There is a contradiction sitting in the middle of this year’s incident response data, and almost nobody is talking about it.
Mandiant’s M-Trends 2026, built on more than 500,000 hours of frontline investigation, reports that the median time between an attacker gaining initial access and handing that access off to a second threat group has collapsed to roughly 22 seconds. Three years earlier it was over eight hours. Access is now brokered at machine speed inside an industrialised criminal supply chain.
The same report says global median dwell time went up. From 11 days to 14.
Read those two numbers together and the standard security narrative falls apart. We are told attacks are getting faster, so detection must get faster. But if everything were simply accelerating, dwell time should be shrinking, not growing. Something else is going on.
There are two adversaries, running two different clocks
The 22-second number and the 14-day number describe different businesses.
The fast clock is economic. Initial access brokers, ransomware affiliates, and automated exploitation crews are optimising for throughput. Get in, verify the asset, sell or escalate. Mandiant also documents ransomware operators pivoting toward what they call recovery denial, deliberately going after backup and disaster-recovery infrastructure to lengthen your remediation window rather than just encrypting production. That is not smash-and-grab. That is someone who has read your runbook.
The slow clock is strategic. The dwell time increase was driven almost entirely by cases where the victim was informed by an outside party. When issues were detected internally, dwell time improved slightly, to nine days. Whereas in cases where victims were notified externally, dwell time jumped to 25 days. At the far end of the spectrum, M-Trends documents the UNC5221 BRICKSTORM campaign averaging something on the order of 393 days inside legal services firms, BPOs, SaaS providers, and technology companies.
An average of more than a year inside these organizations, many of which almost certainly had EDR, a SIEM, and a functioning SOC.
So, the honest summary is not that “attacks have become faster.” It is that the noisy attackers got faster, and the quiet ones got better at not being noisy. Your detection strategy has to answer both, and they need opposite things. The fast clock needs speed. The slow clock needs memory.
What both clocks have in common
This is where it gets uncomfortable, and network visibility stops being a nice-to-have.
Verizon’s 2026 DBIR reports that edge devices and VPNs went from roughly 3% to 22% of exploitation-driven breaches in a single year. VulnCheck’s research on 2025 exploitation found 181 network-edge vulnerabilities under active attack, of which only 23.7% ever made it into CISA’s KEV catalog, and 42.5% affected devices that were end-of-life or effectively unsupported. Exploitation frequently began before a CVE existed.
In February, CISA, the FBI and the UK’s NCSC issued a joint fact sheet on end-of-support edge devices. CISA followed with Binding Operational Directive 26-02, requiring federal agencies to find and remediate them. When three governments coordinate a directive about firewalls and VPN concentrators, the pattern is no longer emerging. It has arrived.
The reason both the fast and slow adversaries converged on the same real estate is simple and structural, edge devices are blind spots by design. Firewalls, load balancers, VPN gateways, and management appliances run proprietary firmware. You cannot install an agent on them. Their logging is thin, often non-persistent, and frequently the first thing an attacker clears. Patching means downtime, so it gets deferred. And when you finally do need to investigate one, it is a closed box with almost no forensic surface.
We spent a decade building strong visibility across endpoints. Attackers adapted by shifting their focus to the parts of the network where that visibility falls short.
For appliances that cannot run endpoint agents, network traffic becomes a critical source of visibility into what is happening across them.
The third clock nobody has budgeted for
Now add something that did not exist in your baseline two years ago. Your own AI agents.
Coding assistants, copilots, and MCP-connected tooling are now moving data across enterprise networks autonomously. That traffic behaves nothing like human-generated traffic. It is persistent rather than ephemeral, bi-directional, high-frequency, and often carried over long-lived JSON-RPC streams instead of the discrete, independently authenticated HTTP requests that most inspection tooling was designed around. Local, studio-based agents running on developer laptops may never touch a gateway at all.
Two practical consequences for anyone doing network detection:
- Your behavioural baselines are quietly rotting. An anomaly model trained on human-paced east-west traffic will either flood you with alerts about legitimate agent activity, or, far worse, silently widen its definition of “normal” until genuine automated exfiltration looks like just another copilot doing its job.
- Agent traffic introduces a new lateral movement path with an identity problem. Agents often operate with broad, standing entitlements. They read files, call internal APIs, and execute commands. Once a prompt injection redirects an agent’s actions, it is not a content-filtering problem. It becomes an authorised identity doing unauthorised things, precisely the kind of behaviour network analytics was built to detect, but one that most current models have never been trained to recognize.
The encryption ground is moving too
One more thing that will land on network teams before most have planned for it.
Post-quantum key exchange is now being deployed in real-world traffic. Hybrid constructions like X25519MLKEM768 appear in a majority of browser traffic. But a 2026 measurement study of over 32,000 domains found that not a single one served a hybrid post-quantum certificate. The industry has addressed key exchange while largely overlooking the authentication half.
For defenders, two things follow. Inline decryption capability for PQC sessions is arriving in stages across major firewall platforms, with meaningful coverage expected to arrive in 2027 for most vendors. That leaves a window where you will see more traffic you cannot decrypt, not less. The handshake itself also becomes a source of intelligence. Which of your systems negotiate PQC, which fall back to classical key exchange, and which quietly downgrade. This gives you a cryptographic inventory you can build passively from the wire, without touching a single asset.
Harvest-now-decrypt-later is not a 2032 problem for organizations whose data must remian confidential for ten-year. It is a today problem, with a delayed penalty.
What is NDR actually for now?
Here is the reframing I would argue for, and it is not the one on most vendor slides.
NDR’s primary job in 2026 is not to be an alarm. It is to be a witness.
Detection matters, obviously. But detection is increasingly a commodity that platform vendors bundle. What is not commoditized, and what nothing else in the stack can produce, is durable, independent, tamper-resistant evidence of what actually crossed the wire including from assets that generate no logs of their own and activity from the period before you knew to look.
Note that this is exactly what both clocks demand. The fast clock needs evidence available quickly enough that an automated or AI-assisted triage decision is grounded in something real rather than inferred. The slow clock needs evidence that still exists when a third party tells you, 25 days or 393 days later, that you have a problem.
That second requirement is the one almost everyone gets wrong. If your full-fidelity retention is seven days and your median externally notified dwell time is 25 days, you have built a system that cannot investigate the incidents you are most likely to be told about. You will have alerts. You will not have answers. And in a breach notification, regulatory response, or insurance claim, “we believe” is not the same as “we can show.”
This is also the unglamorous reason the agentic SOC conversation keeps stalling. Vendors are shipping AI triage agents, but research on them is not primarily about capability. It is about calibration, whether an agent given authority to act can correctly assess the cases in which it is confident. An agent reasoning over enriched alert metadata is doing literary criticism on a summary. An agent reasoning over actual session evidence is doing forensics. The models are broadly similar. The evidence underneath them is not, and that is what decides whether the output is defensible.
The practical version
If you are re-evaluating network visibility this year, here are five questions I would put ahead of any feature comparison:
- Can you see traffic to and from every device on which you cannot install an agent on? Start with edge appliances, then OT, followed by anything that is end-of-support. If BOD 26-02 applies to you, this is now homework with a deadline.
- How long do you retain full-fidelity evidence, and how does that compare with 25 days? Not metadata. Evidence. If the honest answer is “days,” that is the finding everything else is secondary.
- What happens to your behavioural baseline when a coding agent starts moving 200x the data a human analyst does? If nobody has tested this, assume it degrades badly.
- How much of your east-west traffic can you actually decrypt today, and what is your plan for the 2026–2027 PQC gap? If your visibility depends on decryption, you need a metadata and behavioural fallback that works without it.
- When your AI triage layer produces a verdict, what evidence can it point to? If it cannot show its reasoning against primary evidence, you have automated confidence, not investigation.
None of this is a pitch for buying more tools. Most organisations reading this already own something that captures network data. The question is whether it was deployed as an alarm tuned for alert volume, with data retained for a week, and monitoring focused on the segments that were convenient in 2021, or as a witness.
The attackers running both clocks have already worked out which one you built. It would be useful if we did too.
