Breakout time is a measure popularised by CrowdStrike: the time between an attacker’s initial access and their first lateral movement to other systems. Its 2026 Global Threat Report put the average for criminal intrusions at 29 minutes in 2025, with the fastest observed at 27 seconds.
It sets the practical deadline for detection and containment. If an attacker can spread in under half an hour on average, a process that reviews alerts the next morning has already lost, and only automated detection with pre-authorised containment can act inside the window.
Breakout time is often confused with dwell time and with hand-off time between threat groups, which Mandiant measured at a median of 22 seconds in 2025. They measure different things, so quote each with its own definition and source, and never add or average them.