Ransomware Detection Time Shortens by 44% as Organizations Attempt to Keep Up with Attackers

New data shows organizations are improving their ability to detect and respond to ransomware attacks, but is it fast enough to make a difference and stop attacks?

The key to stopping a ransomware attack involves speed and efficacy. Organizations must detect and stop an attack before data is exfiltrated and/or encrypted.

Cybersecurity vendor Mandiant’s latest M-Trends 2024 report shows that organizations improved their speed of detection (which Mandiant refers to as “Dwell Time,” or the number of days from an attacker being present in the environment to detection) from 9 days in 2023 to just 5 days in 2023. That’s a 44% improvement for organizations.

But we also saw another “dwell time” stat from last October, citing that ransomware threat actors only take an average of 1 day from initial access to encryption.

So, it’s great that organizations are detecting ransomware attacks more quickly. But is it enough? If threat actors complete their attacks in 1/5th the time, is detection something to even boast about? What’s not so obvious is that when you dig into the report’s data, you find that 55% of attacks took more than a week to detect.

The real answer here is to prevent attacks in the first place. By the time detection even happens, threat actors have completed their attack and may have “left the building.” Through new-school security awareness training, organizations can stop phishing and social engineering-based attacks by educating users on common techniques, helping to elevate the employee understanding of such attacks and the need for continual vigilance when interacting with email and the web.

Security awareness training empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Information used in this article was provided by our partners at KnowBe4.