The mean time to identify and contain a data breach was 247 days in 2026, according to IBM's Cost of a Data Breach Report 2026, up from 241 days in the 2025 edition. A separate yardstick, Mandiant's M-Trends 2026, measures how long an attacker sits inside a network before being found, and puts the global median at 14 days, up from 11. Both figures rose this year, and both are covered below with their sources.
What is the average time to identify and contain a data breach?
IBM's 2026 report says it takes an average of 247 days to identify and contain an active breach across all industries. The study draws on 602 organizations that experienced breaches between March 2025 and February 2026, and it puts the global average cost of a breach at USD 4.99 million. IBM's 2025 release defined the metric as the mean time to identify and contain a breach, including restore services.
The figure is a mean, so a handful of very long breaches pull it up. It comes from a survey of breached organizations rather than a regulator's records, so it describes the whole lifecycle from first intrusion to containment rather than the moment of discovery alone. IBM does not split the 247 days into separate "identify" and "contain" numbers on its public 2026 pages.
For context on what those months cost, see our breakdown of the average cost of a data breach in 2026, which covers the 2025 report's country and sector figures.
The headline number is roughly eight months, and it moved the wrong way this year.
How has the breach lifecycle changed since 2023?
IBM's lifecycle figure was 277 days in its 2023 report, 258 days in 2024, 241 days in 2025 and 247 days in 2026. The 2025 release described the drop to 241 days as a 17-day reduction and linked it to more organizations detecting breaches internally. The 2026 figure is six days higher, a rise of about 2.5%.
Figure 1: Mean days to identify and contain a breach across four IBM reports. Source: IBM Cost of a Data Breach Reports 2024 to 2026.
Regional releases show the gap between organizations that use security AI and those that do not. In Canada, IBM reported that organizations that used AI in security operations detected breaches in 124 days and contained them in 57 days, against 154 and 71 days without AI. Canada's overall breach lifecycle increased 6% to 205 days. In India, organizations with no AI or automation took 236 days to identify and 75 days to contain, while those with extensive automation took 175 days to identify and 81 days to contain.
Those are regional subsets with their own samples, not a global ranking, and the India result shows automation can speed up identification without speeding up containment.
The number fell in each of the first three reports shown here, and 2026 is the first to climb.
How long do attackers stay hidden before detection?
Mandiant's M-Trends 2026 reports a global median dwell time of 14 days for 2025, up from 11 days in 2024. Dwell time counts the days an attacker is present in an environment before being detected, and the median is the midpoint of the intrusions Mandiant investigated. The 2026 report is based on more than 500,000 hours of incident investigations in 2025.
Mandiant attributes the rise to a subset of adversaries who stay undetected longer, often by persisting in edge devices that lack standard telemetry. Cyber espionage and North Korean IT worker incidents each had a median dwell time of 122 days, and cases involving a stealthy backdoor called BRICKSTORM averaged 393 days. Mandiant says the shift in its distribution reflects the number of those long-running cases.
Figure 2: Global median dwell time in selected years. Source: Mandiant M-Trends 2025 (2014 to 2024) and M-Trends 2026 (2025).
Over the long run the trend is steeply down, from 205 days in 2014 to 10 or 11 days in 2023 and 2024. The 2025 reading of 14 days is a small step back, not a return to the old numbers.
Median dwell time fell by about 95% between 2014 and 2024, and one year of long-running espionage cases nudged it up.
Who detects breaches first, and does it matter?
Organizations first detected evidence of malicious activity themselves in 52% of Mandiant's 2025 investigations, up from 43% in 2024. An external entity notified them 34% of the time, down from 43%, and the attacker announced the compromise in 14% of cases.
Figure 3: Who first detected malicious activity across all 2025 Mandiant investigations. Source: Mandiant M-Trends 2026.
Ransomware looks different. In ransomware cases, adversaries notified the target 44% of the time, internal identification came 41% of the time, and external entities notified 15% of the time. Mandiant says the high share of attacker notifications is consistent with the ransomware business model, since the attacker wants the victim to know.
Smaller firms feel slow discovery most, as our figures on small business data breaches show.
| Who found the intrusion first | Share of 2025 investigations | Share in ransomware cases |
|---|---|---|
| Internal team | 52% | 41% |
| External entity | 34% | 15% |
| The attacker | 14% | 44% |
Source: Mandiant M-Trends 2026.
Finding a breach yourself is becoming the norm in general, but in ransomware the attacker is still the most common messenger.
Does the way a breach is found change how long it lasts?
In Mandiant's 2024 data, intrusions that an external party reported had a median dwell time of 26 days, against 10 days when the organization found them internally and 5 days when the attacker announced themselves. Attacker notification is fastest because extortion actors monetize an intrusion quickly.
Figure 4: Median dwell time in 2024 by detection source. Source: Mandiant M-Trends 2025.
Ransomware compresses the picture further. Mandiant's 2024 median dwell time for ransomware-related intrusions was 6 days overall, and 29 days for the ones discovered internally. So in ransomware, the intrusions the victim found itself had the longest dwell time of the three sources.
The 2025 per-source medians are not in the M-Trends 2026 executive edition, so the 2024 split is the latest one this page can cite directly. Treat it as a pattern rather than a current benchmark.
Attacker-announced intrusions surface fastest, and outside notification came latest in the 2024 data.
What happens after detection: how fast do organizations fix things?
Verizon's 2026 Data Breach Investigations Report analyzed more than 31,000 incidents, of which more than 22,000 were confirmed data breaches in 145 countries. It found exploitation of vulnerabilities is now the most common initial access vector at 31%, while credential abuse fell to 13%. The median time for an organization to patch a known exploited vulnerability in all instances rose to 43 days from 32 days.
Only 26% of the vulnerabilities in CISA's Known Exploited Vulnerabilities catalog were patched across every instance in 2025, down from 38%, in a dataset covering more than 13,000 organizations. The median organization had 16 such vulnerabilities to deal with, against 11 the year before.
Credential leaks are another early warning. Of the ransomware victims that had a prior credential or infostealer event, 50% had it within 95 days before the attack, and 27% of victims had no such event within the year. In other words, a leak often shows up months before the attack does.
Detection is only the first clock, and the clock for fixing what was exploited is running longer too.
How do detection times compare with legal notification clocks?
The legal deadlines for telling regulators and individuals are measured in hours, days and business days, and they start from awareness or discovery rather than from when the attacker got in. GDPR Article 33(1) says a controller must notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of a breach. Under Article 33(2) a processor must notify the controller without undue delay after becoming aware.
Figure 5: Three notification clocks that start at detection, awareness or a materiality decision. Sources: GDPR Article 33, 45 CFR 164.404, SEC press release 2023-139.
HIPAA's breach notification rule requires covered entities to notify individuals without unreasonable delay and in no case later than 60 calendar days after discovery, and treats a breach as discovered on the first day it is known or would have been known by exercising reasonable diligence. The SEC's Form 8-K Item 1.05 is due four business days after a registrant determines a cybersecurity incident is material. Our guide to breach notification deadlines by country lists the rest.
| Rule | Clock | Starts when | Who it applies to |
|---|---|---|---|
| GDPR Article 33 | 72 hours, where feasible | Controller becomes aware | Controllers, with processors alerting controllers |
| HIPAA 45 CFR 164.404 | 60 calendar days maximum | Discovery, including by reasonable diligence | Covered entities, notice to individuals |
| SEC Form 8-K Item 1.05 | 4 business days | Materiality determination | Public company registrants |
This is general information and not legal advice; which rule applies depends on the facts of each incident.
An organization that takes 247 days to find and contain a breach has a very different problem from one that takes 72 hours to report it, and the second clock starts only when the first one ends.
The Bottom Line
IBM's 247-day mean and Mandiant's 14-day median are different measurements of the same problem. One counts the whole breach lifecycle from the start of a breach through its identification and containment, the other counts how long an attacker was present before discovery. Both rose in the latest reports, after years of improvement, and both point to the same operational facts: finding a breach internally is increasingly common, ransomware attackers still announce themselves, and patching known exploited flaws is taking longer. For a site owner, the practical step is to keep a record of what personal data you hold and a written incident plan that names who decides when you are "aware" of a breach. A privacy policy that describes your data practices clearly can help you meet transparency duties, but it does not replace detection, patching or legal advice from counsel on notification deadlines.
Frequently Asked Questions
What is the average time to identify and contain a data breach? 247 days globally, according to IBM's Cost of a Data Breach Report 2026, up from 241 days in the 2025 report and 258 days in 2024. The 2026 study covers 602 organizations breached between March 2025 and February 2026.
What is the average dwell time of an attacker? Mandiant's M-Trends 2026 puts the global median dwell time at 14 days for 2025 investigations, up from 11 days in 2024. Cyber espionage and North Korean IT worker cases had a median of 122 days.
Why do IBM and Mandiant report such different numbers? They measure different things. IBM reports a mean of 247 days to identify and contain a breach, based on surveyed breached organizations. Mandiant reports a median of 14 days that an attacker was present before detection, based on its own incident response investigations.
How quickly must a breach be reported once it is found? It depends on the law. GDPR Article 33 sets 72 hours after becoming aware where feasible, HIPAA sets no later than 60 calendar days after discovery for individual notice, and SEC Form 8-K Item 1.05 is due four business days after a company determines an incident is material. This is general information, not legal advice.
Where the Numbers Come From
- IBM: What Is a Data Breach? (citing Cost of a Data Breach 2026). 247 days to identify and contain, USD 4.99 million global average.
- IBM Canada Newsroom: Canada's Data Breach Costs Hit Record High (July 2026). 602 organizations, Canadian lifecycle of 205 days, AI and no-AI detection and containment days.
- IBM India Newsroom: India Records Its Highest Average Cost of a Data Breach (2026). Identify and contain days with no automation and extensive automation.
- IBM Newsroom: Cost of a Data Breach Report 2025 (July 2025). 241 days, 17-day reduction, metric definition, 600 organizations.
- IBM Newsroom: Cost of a Data Breach Report 2024 (July 2024). 258 days, down from 277.
- Mandiant: M-Trends 2026 Executive Edition. 14-day median dwell time, detection source shares, 122-day espionage cases, BRICKSTORM.
- Google Cloud: M-Trends 2026 (2026). Over 500,000 hours of 2025 investigations.
- Mandiant: M-Trends 2025 Report. Dwell time 2014 to 2024, medians by detection source, ransomware dwell time.
- Verizon: 2026 Data Breach Investigations Report. 31% exploitation, 43-day median remediation, 26% remediated, 95-day credential leak window.
- Regulation (EU) 2016/679: Article 33 (GDPR). 72-hour notification to the supervisory authority.
- 45 CFR 164.404: HIPAA notification to individuals. 60 calendar days after discovery.
- U.S. SEC: Press Release 2023-139 on cybersecurity incident disclosure. Form 8-K Item 1.05, four business days.
Note: All figures verified as of November 2026. IBM, Mandiant and Verizon revise their methods and datasets each year, so figures from different editions are not strictly like-for-like.
