Attackers may begin moving from an initial foothold to other systems within minutes. CrowdStrike reported a 62-minute average eCrime breakout time in 2024, while ReliaQuest reported an average of 48 minutes—and a fastest observed case of 27 minutes—in its 2024 data. These are different vendors’ observations, not a universal countdown for every organization. The practical response is to limit what a compromised account or device can reach, spot unusual movement across systems, and rehearse how to contain it.
How fast can attackers move through a network after getting in?
In the measurements commonly called breakout time, the clock starts at initial compromise and stops when an adversary begins moving laterally to another system. CrowdStrike’s December 2024 report put average eCrime breakout time at 62 minutes. ReliaQuest, reporting on its 2024 observations in 2025, said lateral movement averaged 48 minutes, with a fastest observed time of 27 minutes. Each figure belongs to its publisher’s dataset and definition; neither predicts how long a particular organization will have to respond. CrowdStrike’s 2024 report and ReliaQuest’s reporting describe separate observation populations, not a standardized cross-vendor test.
The key operational lesson is not that every attacker moves on a fixed schedule. It is that defenders should assume internal movement can begin before a conventional investigation has identified the initial compromise. Controls and alerts should therefore make it harder to expand access and easier to recognize suspicious changes in accounts, devices, and connections.
Breakout time, dwell time, and time to exfiltration are different
These measures describe separate stages of an incident. They should not be merged into a single “attacker speed” statistic.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- ENDLESS POWER FROM SOLAR ENERGY: Just 45 minutes of direct sunlight powers the camera for a full day of use, while the built-in battery lasts up to 180 days on a single charge during cloudy days. Solar charging requires temperatures above 32°F.△
- EASY WIRE-FREE INSTALLATION: Place the Tapo SolarCam C402 KIT where you need it without relying on nearby outlets. Install the camera and solar panel together or separately using the included 13 ft cable for flexible placement.
- PRIORITIZE WHAT MATTERS: Set activity zones to monitor specific areas for motion or people. Free person and motion detection helps reduce unwanted alerts and notifies you when activity is detected.
- VERSATILE VIDEO STORAGE: Store footage locally via a microSD card (up to 512GB)* or via cloud with a Tapo Care cloud subscription. Tailor your security to suit your needs, whether indoor or outdoor, you have the storage option you need.
- FULL-COLOR 1080P, DAY AND NIGHT: See clearly in low light with a large-aperture lens and built-in spotlights. Capture full-color night vision up to 30 ft away to monitor for possible intruders or motion.
| Measure | What it tracks | Reported figure and context |
|---|---|---|
| Breakout time | Initial compromise until lateral movement begins | CrowdStrike: 62-minute average eCrime breakout time, reported in 2024. ReliaQuest: 48-minute average and 27-minute fastest observed lateral movement in its 2024 data, published in 2025. CrowdStrike; ReliaQuest |
| Dwell time | An intruder’s presence before discovery; reporting organizations may define the endpoints differently | Mandiant’s M-Trends 2025 reported an 11-day global median for 2024 investigations. Its report gave 26 days when an outside entity notified the organization, 5 days when adversaries notified it, and 10 days when the organization discovered activity internally. These are dwell-time figures, not time to lateral movement. Mandiant, M-Trends 2025 |
| Time to exfiltration | Compromise until data is taken out of the environment | Unit 42 reported a 2-day median in its 2023 incident-response observations, published in 2024; about 45% of cases involved exfiltration within one day. This measures a later intrusion milestone than breakout. Palo Alto Networks Unit 42 |
The populations also differ: CrowdStrike’s figure concerns eCrime cases, ReliaQuest’s reflects its platform observations, Mandiant’s derives from targeted-attack consulting investigations, and Unit 42’s comes from incident-response cases. Mandiant says M-Trends 2025 draws on more than 450,000 hours of consulting investigations; its targeted-attack metrics cover January 1 through December 31, 2024. None of these populations should be treated as representative of every organization or every intrusion. Mandiant’s report
What lateral movement looks like
Once inside, an adversary may map systems and accounts, look for credentials, raise privileges, and connect to additional computers or services. Movement can rely on legitimate accounts, remote services, administrative tools, or files and tools transferred across internal shares. Because those pathways can also support normal IT work, a single event may not be enough to distinguish an attack from routine administration. Context across identity, endpoints, and network activity matters. MITRE ATT&CK’s remote services technique and valid accounts technique provide ways to describe some of these behaviors.
Rank #2
- Enhanced Visual Experience: Immerse yourself in clear and vibrant visuals with the JINSWY 10.1-inch mini monitor. Featuring a 1024×600 resolution, 16:9 aspect ratio, 300 cd/m² brightness, and a 500:1 contrast ratio, it delivers sharp images and balanced colors for everyday viewing. Designed for practical display performance, it offers reliable clarity for work, monitoring, and entertainment.
- Versatile Video Inputs: Equipped with HDMI, VGA, BNC, AV, and USB ports, this small HDMI monitor is compatible with Raspberry Pi, DSLR cameras, PCs, DVDs, TV boxes, Xbox, Nintendo Switch, CCTV systems, car backup cameras, video switchers, FPV setups, and more. Easily turn it into a mini TV by connecting it to a TV box. Perfect for use as a security camera monitor or as part of a small computer monitor setup.
- Portable & Durable Design: JINSWY mini monitor features a slim, lightweight profile with a durable plastic shell, built to withstand everyday use. Measuring 9.92 × 6.5 × 1.34 inches, it is compact enough for mobile, embedded, or space-limited environments — ideal for applications ranging from backup cameras to security systems, and more. This VGA monitor is designed for long-lasting performance across various setups.
- Flexible Installation Options: Mount the portable small computer monitor on the wall using a standard VESA 75 mount (not included) or set it up on a desk with the included adjustable stand. The included remote controller allows for easy operation within a range of 10 meters, adding convenience and flexibility to your setup.
- Wide Range of Applications: Suitable for various uses including home security systems, vehicle displays, Raspberry Pi projects, office multitasking, and entertainment setups. Whether used as a mini monitor, small HDMI monitor, security camera monitor, or VGA monitor, it adapts seamlessly to different environments and needs.
MITRE ATT&CK is a public knowledge base for organizing adversary tactics and techniques, and for connecting them to detection and mitigation work. Teams can use its technique pages and mitigation catalog to review what they monitor, build exercises, and identify gaps. MITRE ATT&CK describes itself as “a knowledge base that helps model cyber adversaries’ tactics and techniques—and then shows you how to detect or stop them.”
How can we stop lateral movement?
No single control guarantees that an attacker cannot move. The goal is to reduce the reach of a compromised account or device, detect movement early, and give responders a practiced way to contain it.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- 17inch LED Security Monitor, Ultra fine pixel pitch for close viewing in surveillance applications,170 °viewing angle for fewer restrictions on your range of vision
- CCTV monitor:With multiple ports: HDMI, AV, 3.5mm Audio Input/Output and VGA. perfect for connecting with CCTV monitor and DVR system. Also works for PC, DVD Box and MP5 etc..
- Functions: This security monitor screen comes with 2 built-in speakers. With built-in USB port media player. It can play movies or videos simply by USB disk. Great for Home/Office/Store Surveillance Camera STB, DVR, NVR, PC, DVD Player.
- Package Included & Best Service: 17inch CCTV security monitor x1,Power Adaptor x 1, Remote Control x 1,Manual x 1. DOA or within 30 days free money back, or unconditional replacement within 1 Year. Should you have any problem please feel free to contact us, we always stand behind the products.
- monitor for security cameras
- Make activity visible across systems. Collect and correlate relevant endpoint, identity, cloud, and network logs. A view limited to one device or one log source can miss the links between a suspicious sign-in, privilege change, and new internal connection. CISA’s cybersecurity performance goals
- Protect accounts and privileges. Require strong multifactor authentication, including FIDO2-compliant MFA where appropriate. Limit standing administrative privileges, safeguard privileged accounts, and apply least privilege so an account has only the access needed for its work. CISA’s account-security guidance
- Segment networks and restrict application access. Separate critical systems from areas where compromise is more likely, and limit which users and services can connect across those boundaries. Segmentation constrains the paths available for internal movement. MITRE ATT&CK: Network Segmentation
- Patch exposed systems and watch administrative pathways. Keep internet-facing and otherwise exposed systems hardened and updated. Monitor remote-management services and administrative tools for use that is unusual for the account, device, or time of activity. CISA’s Known Exploited Vulnerabilities Catalog
- Practice incident response and measure your own times. Maintain an incident-response plan, exercise it, and track how long your team takes to detect, investigate, and contain activity in your environment. Threat hunting can help find activity that automated alerts miss when staffing and expertise allow. CISA incident-response plan basics
Automation can shorten containment in some environments, but results should be interpreted in context. ReliaQuest reported mean time to contain as low as three minutes for customers using automated workflows, compared with 6.3 hours without automation. This is a vendor-reported customer comparison, not a controlled guarantee for other organizations. ReliaQuest
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to take from the numbers
Published figures show that lateral movement can start quickly, but they do not establish a common deadline or a like-for-like ranking of security providers. Use them as a reason to test whether your own identity, endpoint, and network controls can limit access—and whether your response team can act on a suspicious signal—rather than as a promise of how much time you have.
Quick Recap
Rank #4
- 16inch LED Security Monitor, Ultra fine pixel pitch for close viewing in surveillance applications,170 °viewing angle for fewer restrictions on your range of vision
- CCTV monitor:With multiple ports: HDMI, AV, 3.5mm Audio Input/Output and VGA. perfect for connecting with CCTV monitor and DVR system. Also works for PC, DVD Box and MP5 etc..
- Functions: This security monitor screen comes with 2 built-in speakers. With built-in USB port media player. It can play movies or videos simply by USB disk. Great for Home/Office/Store Surveillance Camera STB, DVR, NVR, PC, DVD Player.
- Package Included & Best Service: 15.6inch CCTV security monitor x1,Power Adaptor x 1, Remote Control x 1,Manual x 1. DOA or within 30 days free money back, or unconditional replacement within 1 Year. Should you have any problem please feel free to contact us, we always stand behind the products.
- monitor for security cameras
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
