Threat Actors Now Penetrate Enterprise Infrastructure in 18 Minutes

In a recent article, Cybersecurity News revealed that threat actors can now break into enterprise infrastructure in as little as 18 minutes from initial access (cybersecuritynews.com). Even more alarming, the fastest observed attack took only six minutes, when the Akira ransomware group exploited a SonicWall VPN and moved laterally inside the target environment.

This speed of attack changes everything. Security teams can no longer rely solely on detecting threats and responding after the fact. By the time a detection alert triggers, attackers may already have infiltrated critical systems or deployed ransomware. The new security reality requires isolation and containment, not just detection and reaction.

The Shrinking Window for Defense

ReliaQuest analysts, cited in the article, explain that attackers are accelerating their operations using automation, stealth, and trusted system tools. Their tactics include:

• Using trusted binaries like rundll32.exe to execute malicious code undetected

• Creating scheduled tasks that blend in with legitimate system operations

• Spreading through USB attacks or by inserting malicious DLLs

• Disguising trojanized IT tools such as fake versions of PuTTY to trick administrators

These techniques allow attackers to move fast and stay hidden, often using the same files and processes your systems trust. That means tools dependent on signatures, anomaly detection, or behavioral analytics are often blind to what’s happening.

When attackers can move laterally, escalate privileges, and establish persistence in minutes, traditional defense methods simply cannot keep up.

The Limits of Detect and Respond

Most organizations still depend on a “Detect and Respond” security model. This involves catching intrusions through alerts, then investigating, containing, and remediating after the fact. But with intrusion-to-impact times dropping to minutes, that approach no longer works.

Here’s why:

1. Detection is reactive. It happens after the attack begins.

2. Response takes time. Human analysts or automation still need to review, decide, and act.

3. Remediation is messy. Attackers may have already gained persistence or exfiltrated data.

4. Recovery is costly. Every minute lost increases downtime and financial impact.

When attackers can breach, spread, and encrypt within 18 minutes, you cannot afford to wait for alerts. You need a system that prevents malicious actions before they can cause harm. That is where Isolation and Containment becomes essential.

Why Businesses Need AppGuard

AppGuard is a proven endpoint protection solution with a 10-year track record of success in defending against advanced threats. Unlike tools that rely on detection or signatures, AppGuard enforces Isolation and Containment by design.

What makes AppGuard different:

• Prevention-first architecture: AppGuard stops unauthorized or risky actions before they can execute.

• Zero-trust for applications: Even trusted applications are restricted from performing unsafe actions.

• Stops lateral movement: Prevents processes from injecting code or spreading across systems.

• No signature updates required: It protects against known and unknown threats automatically.

• Minimal disruption: By focusing on isolation rather than blocking, AppGuard avoids false positives that disrupt workflows.

In practice, AppGuard neutralizes attacks before they can spread or escalate. Even if a malicious file enters your system, it cannot execute or cause damage. This is a proactive model built for today’s speed of attack.

From Detection to Containment

The article highlights a key truth: defenders are running out of time. Threat actors no longer need days or weeks to breach systems; they need minutes. The only viable strategy now is to assume attackers will get in — and make sure they can’t do anything once they do.

That’s the power of AppGuard’s Isolation and Containment model. Instead of waiting for an alert, it automatically blocks harmful behavior at the process level. The result is prevention in real time, not reaction after the fact.

This evolution in defense strategy is what modern enterprises need to survive.

A Call to Action

If your organization still relies on “Detect and Respond,” it’s time to make a change. When attackers can break into your infrastructure in 18 minutes, there’s no margin for delay.

At CHIPS, we help businesses deploy AppGuard to move beyond detection and embrace true prevention through Isolation and Containment. AppGuard stops attacks before they spread, keeping your systems secure even when traditional tools fail.

Business owners: talk with us at CHIPS today to learn how AppGuard can prevent the kind of rapid, devastating intrusions described in Threat Actors Breaking to Enterprise Infrastructure Within 18 Minutes From Initial Access.

It’s time to move from detect and respond to isolate and contain — and stop threats before they start.

Like this article? Please share it with others!