Breach Detection: Every Extra Day Has a Price
Preventing every breach is not realistic, so the question becomes how fast you notice one. Detection is the work of shortening the time between an intruder getting in and someone knowing about it. This guide explains what recent industry data says about that time, the warning signs to watch for, the main ways breaches are found, the incident response lifecycle NIST uses, a first-24-hours checklist, and a made-up example of how the cost grows with every day. It is general education, not legal or security advice for your situation.
The short answer
Breach detection means finding unauthorized access to your systems or data, ideally quickly. The longer an intruder stays unnoticed, the more they can see, copy or damage.
Detection depends on three things: having the right logs and alerts, having someone whose job it is to look at them, and having a plan for what happens next.
For the wider picture on how attackers operate, see our guide to cyber espionage, which covers long-running intrusions.
What the data says about detection time
Security firms publish yearly figures based on the incidents they investigate. The most useful one for this topic is dwell time: the number of days an intruder is in a network before being found.
Mandiant, part of Google, reported in M-Trends 2026, which covers investigations from 2025, that the global median dwell time was 14 days, up from 11. It also reported that 52 percent of investigations were first detected internally, up from 43 percent in 2024. Exploits were the most common first step at 32 percent.
You may also see a much larger figure. IBM’s 2025 Cost of a Data Breach report, as covered in the press, put the mean time to identify and contain a breach at 241 days and the global average cost at $4.44 million.
Why 14 days and 241? The two numbers measure different things:
- One is a median and the other is a mean. A few very long breaches pull a mean up.
- One counts the time until the intruder is found. The other counts the time until the breach is also contained.
- The samples differ. Each report draws on a different set of organizations.
Treat all of these as rough guides. Both reports come from firms that sell security services, and both look at organizations that had a breach serious enough to be investigated or studied. Your own numbers could be better or worse.
Warning signs
| Sign | Where you might see it | Could also be |
|---|---|---|
| Logins from unusual places or times | Sign-in logs, a login alert email | An employee traveling or using a VPN |
| A new admin account or permission change | Account and access logs | A planned change nobody recorded |
| Large or odd outbound data transfers | Network monitoring, cloud usage reports | A backup or a big legitimate upload |
| Security tools turned off | Endpoint protection console | A failed update |
| Hidden mailbox rules forwarding mail | Email settings | A rule an employee set up |
| Password reset or verification messages nobody requested | Staff or customer reports | Someone mistyping an address |
| Files renamed, locked or a ransom note | Shared drives, desktops | Rarely anything else |
| Cloud storage open to the public | Cloud configuration checks | A deliberate public site |
| Customers reporting fraud tied to your service | Support tickets | A breach somewhere else |
Any one of these may be harmless. The skill is in noticing patterns and checking quickly. One cloud-specific point: a database or storage bucket left open by mistake is a breach waiting to happen, and it may leave no trace of intrusion at all. Regular configuration checks catch this kind of exposure.
How breaches are found
| Source | What it catches well | What it can miss |
|---|---|---|
| Log review and automated alerts | Unusual logins, permission changes, unusual data movement | Anything not logged, and alerts nobody reads |
| Endpoint protection on laptops and servers | Known malware and suspicious behavior on a device | An intruder using legitimate accounts and tools |
| Network monitoring | Odd traffic patterns and connections to bad destinations | Encrypted traffic you cannot inspect |
| Cloud configuration checks | Open storage, weak access settings | Misuse by a valid account |
| Staff and customer reports | Strange emails, odd account activity | Anything people do not notice or report |
| Decoys and tripwires | An intruder opening a fake file or account | Intruders who never touch the decoy |
| External notice | Alerts from law enforcement, a vendor or a researcher | You learn late, on their schedule |
The M-Trends figure above implies the other 48 percent were first flagged from outside the organization. That is the external-notice row, and it is the one most teams want to avoid.
For smaller organizations, the NIST ideas in our cyber espionage guide include a short checklist you can adapt.
The response lifecycle and a first-24-hours checklist
In April 2025 NIST finalized SP 800-61 Revision 3, its incident response guidance. It is built around the NIST Cybersecurity Framework 2.0, and the NIST incident response page describes a model with three parts:
- Preparation: the Govern, Identify and Protect functions. NIST says these are not part of the incident response itself.
- Incident response: Detect, Respond and Recover.
- Improvement: lessons from each incident feed back into all functions.
If you have heard the older four-step model (preparation; detection and analysis; containment, eradication and recovery; post-incident activity), this is the newer framing of the same ideas.
Here is a first-24-hours checklist in our own words. Your own plan comes first, and you may need legal, insurance and technical help.
| Time | Action |
|---|---|
| Hour 0–1 | Confirm it is real. Start a written log with times, who found what and what was done. |
| Hour 1–4 | Limit the damage: disconnect affected devices from the network and reset exposed passwords. Do not wipe machines yet, because you may need the evidence. |
| Hour 4–12 | Work out what was reached: which accounts, systems and data. Preserve logs. Contact your cyber insurer if you have one. |
| Hour 12–24 | Bring in a lawyer and, if needed, an incident response firm. Check which notification rules apply. They vary by place and industry. Prepare a short, factual message for staff and customers. |
| After 24 hours | Eradicate and recover from clean backups. Then review what you missed and update the plan. |
A worked example: what each day of delay costs
This example is made up, and its inputs are guesses. A small firm’s customer database is accessed by an intruder on day 0. The intruder starts copying records on day 2 at 500 records a day. We assume each exposed person costs the firm $15 in notification, support and monitoring.
The table shows three detection times. Records exposed = (detection day − 2) × 500.
| Detected on day | Days of copying | Records exposed | Made-up cost at $15 each |
|---|---|---|---|
| 3 | 1 | 500 | $7,500 |
| 14 (the M-Trends median) | 12 | 6,000 | $90,000 |
| 60 | 58 | 29,000 | $435,000 |
What it shows: in this model, cost rises in proportion to the days the intruder is undetected. Moving from day 14 to day 3 cuts the exposure by 5,500 records, or $82,500 at these inputs.
What it leaves out: legal costs, lost customers, fines, downtime, and the fact that attackers do not copy at a steady rate. The $15 figure is an assumption, not a published average. Change it to match your own situation.
Use the idea, not the numbers: ask what a day of delay would cost you, then compare that to what faster detection costs.
If you receive a breach notice
Many people learn about a breach from a letter or email from a company they deal with. This is general guidance for individuals:
- Check the notice is real. Do not click links in it. Go to the company’s website directly. Scammers send fake breach notices.
- Change the password for that account, and for any other account where you used the same one.
- Turn on multi-factor authentication where it is offered.
- Watch your accounts and statements for charges you do not recognize.
- Consider a credit freeze if sensitive data like a Social Security number was exposed. In the United States the FTC’s IdentityTheft.gov explains recovery steps.
- Expect follow-up scams. People whose details leaked often get convincing phishing messages afterward.
Common mistakes
- Collecting logs nobody reads. An alert with no owner is the same as no alert.
- Wiping machines too soon. You may destroy the evidence you need to know what happened.
- Investing only in prevention. Some attacks will get through. Plan for finding them.
- Announcing before you have facts. An early wrong statement is hard to take back. Check with counsel.
- Forgetting the cloud. Misconfigured storage and old accounts are easy to miss.
- Having no plan until it happens. Decide in advance who calls whom.
Learn more
If you want structured learning, online providers such as Coursera and Udemy list information security courses, some covering detection and response. We may earn a commission if you sign up, at no cost to you. We are not affiliated with any university. Check the syllabus and update date, because this field changes fast. For credentials and career paths, see our guide to information security management certificates.
Frequently asked questions
What is breach detection?
The process of finding unauthorized access to systems or data, through monitoring, alerts, reviews and reports.
What is dwell time?
The number of days an intruder is inside a network before being found. M-Trends 2026 reported a global median of 14 days for 2025 investigations.
What are the first signs of a data breach?
Unusual logins, new admin accounts, odd data transfers, security tools turned off, unexplained password resets and customer fraud reports. Any one can have an innocent cause.
What should I do first if I think there is a breach?
Confirm it, start a written log, limit the damage without wiping evidence, and call your lawyer, insurer or response firm. See the checklist above.
How are most breaches discovered?
M-Trends 2026 reported that 52 percent of 2025 investigations were first detected internally. That implies the other 48 percent were first flagged from outside. Figures vary by report and year.
Do I need to notify people about a breach?
Often, but the rules depend on where you operate, what data was exposed and your industry. Ask a lawyer. We cannot give legal advice.
Browse certificate, course and degree programs side by side.