M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds
Summary
Mandiant's M-Trends 2026 report, based on over 500,000 hours of incident response investigations in 2025, indicates a significant reduction in the time it takes for threat actors to transition from initial access to a "handoff" stage. This transition has decreased from hours to an average of just 22 seconds.
IFF Assessment
The rapid reduction in time for initial access handoffs indicates attackers are becoming more efficient and automated, reducing the window of opportunity for defenders to detect and respond.
Defender Context
Defenders must focus on rapid detection and response capabilities to counter increasingly agile threat actors. This trend highlights the need for robust security monitoring and automated threat hunting to detect malicious activity within seconds rather than hours.