Historical intelligence backfill. This assessment covers reporting originally published on 2026-03-23 and was added to the RWP archive on 2026-09-07.

Daily Top · Enterprise Security

M-Trends 2026 — median dwell went the wrong way, and the handoff is 22 seconds

Mandiant 23 March 2026 — 500,000+ IR hours in 2025. Global median dwell 14 days (was 11). Access-broker handoff 22 seconds (was 8+ hours in 2022). Exploits still #1 initial vector at 32%. Espionage and DPRK IT-worker medians 122 days.

RWP Ventures · 2026-09-07 · event 2026-03-23 · 1 min read · priority 8.3

Bottom line up front

CONFIRMED 23 March 2026 Mandiant M-Trends 2026, from >500,000 hours of 2025 investigations. Global median dwell 14 days, up from 11 in 2024 — two years in the wrong direction after a decade of improvement. Espionage and North Korean IT-worker cases: median 122 days. Exploits remain the top initial vector sixth year running (32%). Internal detection 52%; external notification 34%. The number that should change IR runbooks: median time from initial access to handoff to a secondary group collapsed from >8 hours (2022) to 22 seconds (2025).

ASSESSED 90-day log retention is a briefing error when BRICKSTORM-class dwell is ~400 days and broker-to-ransomware is under a minute. This is not OT malware. It is why “we would have seen the encryptor” is not a control.

What happened

Mandiant’s annual IR census, not a single intrusion. Dwell up because long-stay actors (espionage, fake IT workers) pull the median; internal-detect dwell can still look fine.

Why it matters

You do not get a coffee between foothold and affiliate. Containment clocks that assume hours are fan fiction.

What is confirmed vs not

CONFIRMED Mandiant metrics as published.

NOT: a new CVE.

What defenders should do

Assume brokered access is already sold. Isolate on first-stage, not on ransom note.
Keep identity and edge logs longer than 90 days.
Exploits still beat phishing as Mandiant’s #1 door — patch SLAs are the census.

RWP assessment

Confidence: High on the numbers. Brief 22 seconds to the board, not “dwell is 14 days so we have two weeks.”