Latest / TeqTalk with Jas / Attackers Move in 29 Minutes. Your Defense Takes 6 Months.
Transcript
- Teqfocus: Let me ask you one question before we actually start. If an attacker entered your company right now while you are watching this, how long would it take your team to actually know? Not what your dashboard says, not what your last audit reported, not what was presented at the last board meeting, actually know. Because CrowdStrike's 2026 Global Threat report found that the average attacker moves from getting into the spreading across your systems in just 29 minutes. The fastest? Is 27 seconds. And IBM's 2025 cost of data breach report found that the average organization takes 181 days to identify a breach and another 60 days to contain it. Let me put this side by side. Attacker moves in 29 minutes, enterprise discovers it in 181 days. That gap is not a technology problem, it is a business continuity problem. And here is what it makes it worse in 2026. Attackers now have AI, they are using it. To write perfect phishing emails, move faster through environments, and impersonate your leadership convincingly enough to authorize financial transactions. One example, in 2024, a finance employee at Aru, a global engineering firm, transferred $25 million after a deep fake video call that appeared to show their CFO and colleagues. Every participant was fabricated. And this is not what I am saying, it is as per Financial Times 2024. So that was not a phishing email, it was a fake boardroom. So the old question, can we keep attackers out, is no longer sufficient. The right question for every leader today is when they get in, how far they can go and how fast can we stop them? So this is what today's episode answers. So we are covering three things today. One, how attackers actually get in today. Two, what the 29-minute attack chinks look like in plain English. Three, the guard framework. Five pillars, five boardroom questions. Practical, actionable, yours to take into your next leadership meeting. So let's start with our first topic. So think of your enterprise like a large international airport. Every day, thousands of people move through it. Employees, vendors, partners, contractors, devices, applications, APIs, the terminals are your business applications, the gates are your access points, the baggage systems are your data pipelines, air traffic control is your critical infrastructure. And in the perfect world, everyone inside the airport is supposed to be trusted. Now imagine one person gets hold of a genuine staff badge. They do not break the door, they do not cut the fence, they do not even look suspicious. They just batch it. They walk through the same gate as everyone else. They move through the restricted areas. They blend into the normal flow of business. And that is a modern cyber attack. The most dangerous breaches today often do not start with a hacker breaking in. They start with someone logging in using the credentials that look completely legitimate. And this is where many leaders get it wrong. They assume an attacker needs to be highly technical to enter the system. But in reality, there are many ways to get that patch. Sometimes it starts with phishing and social engineering. An employee receives an email that looks like it came from the CFO, ID support, or a trusted vendor. No spelling mistakes, no obvious red flags, just one urgent message, one convincing link, one rushed click. And suddenly the attacker has the Sometimes it starts with credential-based attack. A username and password leaked in the previous breach are reused somewhere else. The attacker does not need to guess anything. They simply try the key to another door and it opens. Sometimes it's MFA fatigue. The attacker already has a password. Now they flood the employee's phone and approval request late at night. The employee is tired, confused, frustrated. One tap to make it stop and the attacker's walking. Sometimes the badge doesn't come from your employee at all. It comes through your supply chain. A vendor, a contractor, or a third-party system that has legitimate access to your environment, the attacker compromises them first, then quietly uses that trusted connection to reach you. And sometimes the threat is already inside. A careless user, a compromised partner account, these are the hardest to detect. So the real question is no longer can hackers really break into the airport. The question is. How many people are walking around with the badge they shouldn't have? And once they are inside, you can actually see where they are going. Because in today's enterprise, the breach does not begin when data is stolen. It begins much earlier, when trust is given to the wrong identity. In 2023, NGM Resorts was hit by a cyber attack that reportedly began with a social engineering call. To its IT help desk. Attackers impersonated an employee, gained access, and disrupted hotel and casino operations across MGM properties. And that led to a negative impact of 100 million on its third quarter design. So now we know the first truth: attackers do not always hack in, they log in. And that brings us to our second topic of the day. What happens after they get inside? Because the next 29 minutes can decide whether this remains a small incident. Or become a full-scale breach. Let's see, they get the batch. One AI generated phishing email, no spelling mistake, no red flag, written by tools like WormGPT and underground AI model with no safety guardrails. One click, credentials stolen, badge acquired. Or they use MFA fatigue, flooding a user's phone with push notification. One tap, full access. Minutes 1 to 10. They learn the airport. Quite patient. Then map your Active Directory, find domain controllers, identify forgotten service accounts, locate the contractor batch that still opens door from the project that was closed two years ago. This is where identity scroll becomes your biggest hidden vulnerability. Too many users with too much access, too many forgotten accounts, too many systems connected without clear ownership. To leadership, operational complexity to an attacker or master key. And if your enterprise has deployed AI co-pilot, With broad access to internal documents and emails, the attacker doesn't even need to explore manually. They can simply ask it, show me all the documents labeled confidential. Summarize the last 90 days of finance communication. Your own AI tools become your problem. Now, 10 minutes to 29 minutes. They find the master key and move. One old service account with an unchanged password, one developer token with production access, one week link up but then lateral movement. Using your own tools, remote desktop, PowerShell, file shares, no new malware, no signatures to catch. The solar wind attackers did exactly this. They moved silently through the networks of US government, agency, and Fortune 500 companies for up to 14 months, using legitimate tools mimicking normal traffic, staying below thresholds before anyone knew. And 14 months inside, undetected. By the 29 minutes in your environment. One compromise batch can become access to your financial system, your customer records, your executive communication, your cloud management console. And your security team may still be asking: Is this alert real or it's just a noise? I want to pause here because early in my career, I was a part of a response to the breach that had been running for 11 days before anyone in the organization knew. The attacker was patient, slow, deliberate. Staying below detection thresholds the entire time. An alert had fire on day two. An unusual service account login, low severity, it sat in a queue, nobody actually touched it. Not because the team was bad, because it had hundreds of alerts, limited context, nothing connecting that single flag to anything significant. The signal was there, the noise buried it. But today, with AI-powered behavioral analytics, That incident would have been stopped on day two. Because the AI would have connected that login anomaly to two other low severity signals from the same 48 hours, assessed the combined risk as critical, and triggered automated containment before actually humans opened the ticket. So this is a shift, a fundamentally different operating model altogether. Now we have seen the dangerous part once attacker gets inside. They move fast, quietly, and intelligently. That brings us to our third topic: the guard framework. Five leadership questions every company should ask, along with tools that can help answer them before the next breaches begin. Let's start. The Guard Framework. G stands for govern identities. The badge is the entry point. Batch governance is your first line of defense. If a senior leader's credentials are stolen tonight, what can the attacker access? Traditional security asks one question at login. Is this the right password? Pass or fail? Session trusted. AI asks a different question. Does this behavior look like a real person? Platforms like Intra ID and Okta can really run continuous risk core on every login and every session, device location behaviour, time of the day, global threat signals, anomaly detected and access blocked automatically. No help test ticket, no human in the loop, it happens in milliseconds. And the leadership leverage, you are no longer relying on your employee to spot a perfect phishing email at 8 a.m. on a Monday. AI is watching every login, every session, every access request, and making real time judgments that used to require a human analyst. And your boardroom question? If credentials are compromised tonight, how quickly does your AI system know something is wrong? Unify detection. A good airport doesn't have just cameras at each gate. It has a unified control room that Sees the whole picture. So most enterprises do not lack alerts, they lack connected context. One identity alert, one endpoint alert, one cloud alert. Separately they look minor. Together, they show an attack in progress. Behavioral analytics platforms like Microsoft Sentinel. And SecureNix builds the baseline for every user and device. An attacker using valid credentials and legitimate tools still looks behaviorally wrong to an AI that knows what normal looks like. The signal does not get buried. And your boredroom question for this what is your real mean time to detect? Not the dashboard number, but the actual time between attacker entry and your team knowing. A. When a threat is identified at an airport, nobody convenes a committee. Pre-design protocols execute immediately. So in ransomware behavior starts at 2 a.m. on a Sunday, does containment require a human to be away? Colonial Pipeline 2021. Attackers gain access through one legacy, VPN account with no MFA. Ransom were deployed, 5500 miles of fuel pipelines shut down, six days of disruption across the US East Coast. A 4.4 million ransom paid. So one legacy account, no automated containment, national infrastructure halted. So AI can really help in defending. SOAR platforms like Splunk SOR execute pre-approved playbook automatically, isolate the endpoints, revoke the tokens, preserve evidence, notify the team in just under 60 seconds without human approval. Automation doesn't replace judgment but it buys human time. So your modem question for this is: if ransomware starts at 2 am on Sunday, does your containment response require a human to be awake? Or restrict blast radius. One-stuffed badge should not open every door on the airport. Change Healthcare 2024, attackers entered through the remote access portal with no MFA. The network was insufficiently segmented. They reached the systems containing the records of 192.7 million individuals, the largest healthcare data breach in the US history. Payments disrupted, pharmacy affected, patients impacted. One entry point: flat network enterprise-wide crisis. Tools like Illumio, MAP. Every east-west communication in your environment, 30 days of passive observation, recommend segmentation policies based on what they actually see. Z-scaler, zero trust network access, replaces VPN with application-level services. Users reach out only what they need, nothing else. No network to move literally through. Your mode room question for this is: if one device in your organization were compromised right now, how many critical systems could an attacker reach from it? D. Defend AI system. The airport just installed a powerful new information kiosk that can answer any question about any passenger, any cargo, any staff schedule with no access restrictions and no query logs. That is what an ungoverned enterprise AI looks like. In 2023, Samsung engineers pasted proprietary source code and confidential meeting notes into ChatGP to help them with their work. The data left Samsung's control and trial. Samsung subsequently Ban Gen AI tools on the company devices. That was not malicious, that was productivity. This is happening in your organization right now. Now imagine a deliberate attacker using your own enterprise AI co-pilot through a compromise identity to surface MA documents, client data, board communications through normal-looking queries. No traditional security alerts are fired, the data leaves through your own tool. Now, how AI can defend this is tools like Microsoft Purview Sensitivity. Labels restrict what copilot can surface. AI query logging treated as privileged access logging, unusual pattern-triggered behavioral alerts, input and output guardrails block prompt injection setups. The principle: your AI tools are not extempt security control you apply to everything else. Bottom question: Do you know exactly what your AI tools can access? And if you are actively monitoring, How they are being used. Let me bring this back to the airport one final time. A well-run airport does not build a higher fence and hope nobody gets through. It operates on assumption that eventually something will happen and it designs every system, every protocol, and every response capability around one question. When something gets through, how far can we go? How fast can we contain it? That is a mindset shift enterprise security need in 2020. And here is what I genuinely believe after years of working on both the sides of this problem. AI has given defenders something they have not had in a long time, the ability to match attackers' suite. Not to guarantee no breach will ever happen, but to shrink the window from months to minutes. That shift is available right now to any enterprise that chooses to build around Guard as a framework. Five pillars, five board questions, one framework. And what I want to leave you with is. One same question I open with. If an attacker entered your organization right now, how long would it take you to actually know? If the honest answer is days, weeks, or months, that is where the work begins. If this kind of leadership briefing is useful, where we cut through the noise and focus on what actually matters for enterprise decisioning, subscribe to Tech Talk. Every week, one important enterprise topic broken down for leaders and practitioners. Every two weeks a conversation with someone building this in real world. Subscribe and share with the leaders who should be sitting with the 29 minute question.