Attackers spend 11 days in a network before detection The median attacker dwell time before detection is 11 days or 256 hours, according to data from Sophos. That's time in which they're free to conduct malicious activity, such as lateral movement, reconnaissance, credential dumping, data exfiltration, and more. The company has released an 'Active Adversary Playbook' detailing attacker behaviors and the tools, techniques and procedures (TTPs) that Sophos' frontline threat hunters and incident responders saw in the wild in 2020. Other findings include that 90 percent of attacks seen involve the use of the Remote Desktop Protocol (RDP) -- and in 69 percent of all cases, attackers used RDP for internal lateral movement. While security measures for RDP, such a VPNs and multi-factor authentication tend to focus on protecting external access these don’t work if the attacker is already inside the network.