The SOC’s window is closing dangerously fast

Twenty-nine minutes. That is how long, on average, passed in 2025 between the moment an eCrime attacker got into the first computer and the moment they moved on through the network, according to CrowdStrike’s 2026 Global Threat Report. In our field we call it breakout time. For defenders, it is something else: “the last chance”.

As long as the attacker sits on one machine, it is an incident. Once they move on, the company is in crisis.

The latest reported average: 29 minutes

In 2022, defenders had 84 minutes on average. In 2025, they had 29. In three years, the window shrank by roughly 66%.

And on our side, time has been a problem too: in IBM and Morning Consult’s 2023 study, almost half of SOC team members reported that detection and response took longer than two years earlier. The attacker is speeding up; defenders cannot afford to stand still.

By 2028: around 10 minutes

I am not making any dramatic assumptions. We simply let the trend run on at the same proportional pace as from 2022 to 2025. That puts the average window in 2028 at around 10 minutes. This is an Oryen projection, not a measured result or a CrowdStrike forecast.

What the new reality means

It is not just a smaller number. It is a different world.

An alert used to be able to wait in the queue for a while. The analyst opened it, went through the logs in five consoles, called the server administrator and still had time to spare.

That margin is gone. Attacks today are far more sophisticated. Attackers combine stolen identities, legitimate tools and cloud services, so their traces blend into normal operations. Investigating such an alert takes longer: it needs more sources, more context about the user and the system, and more joining of the dots across tools. The work per alert keeps growing while the time for it keeps shrinking.

If that trend continues to 2028, the queue will stop working altogether. Even if we start investigating immediately, by the time we finish the attacker will be long gone. Not to mention that attackers are adding artificial intelligence and will get faster still.

This is not about analysts falling short in their skills. Their experience and judgement are more valuable in the SOC than ever. It is about time. Without help from machines, evidence collection, context and the decision simply will not fit into such a window.

Let me put it plainly. A model in which every alert passes through human hands first cannot be sustained in the new reality.

What to do about it

People in the SOC need help. Not another console and not another queue, but something that takes over the work that exhausts them and holds them back.

I see three steps.

1. Investigate at machine speed. Collecting evidence, querying logs, identities and asset inventories, comparing with history. An hour’s work for a person, minutes for a machine. Every alert should become a tested hypothesis before a human even gets to it.
2. Close only with proof. Speed without proof is just a faster road to a mistake. A silent wrong close is worse than a slow one. What is not proven does not close; it goes to a human. Every close must be auditable.
3. People decide, they don’t dig. The analyst receives all available information from the machine in one place, and their job is to decide only where it truly matters: in critical cases and in complex situations that need human insight. Everything else that is provably harmless is closed automatically, with proof.

Faster investigation does not close the window by itself; the attack still has to be stopped. But it gives back the minutes, so the decision lands inside the window, not after it. By 2028, those minutes will be the most valuable thing a SOC has.

Sources

• CrowdStrike, 2026 Global Threat Report (24 February 2026): average eCrime breakout time of 29 minutes in 2025.
• CrowdStrike, 2024 Global Threat Report (21 February 2024): 84 minutes in 2022.
• IBM / Morning Consult, Global Security Operations Center Study (March 2023): 46% of surveyed SOC team members reported longer detection and response times over the preceding two years.
• The 2028 estimate is Oryen’s projection at the 2022–2025 proportional rate of decline: 29 × (29 / 84) ≈ 10 minutes.