Skip to main content

CYBERSTATS

Security Intelligence

Back to Home

The average time from initial access to domain control has shrunk to under two hours.

DirectDefense
April 15, 2025
Initial accessDomain control

The average time from initial access to domain control has shrunk to under two hours. — This cybersecurity statistic was published by DirectDefense in April 2025. It covers topics including Initial access, Domain control. The original data appears in 2025 Security Operations Threat Report. For the full methodology and detailed findings, refer to the original report.

Source

View Original Report

Published on 4/15/2025

Share or Copy this stat

Frequently Asked Questions

What does this statistic say?

The average time from initial access to domain control has shrunk to under two hours. This data was published by DirectDefense and covers Initial access, Domain control.

Where does this data come from?

This statistic comes from 2025 Security Operations Threat Report, published by DirectDefense on April 15, 2025. You can view the original report at https://www.directdefense.com/gain-clarity/threat-report/.

What cybersecurity topics does this cover?

This statistic relates to Initial access, Domain control. Browse more statistics on Initial access or from DirectDefense.

Want More Statistics Like This?

Get the latest cybersecurity stats delivered to your inbox every week

Related Statistics

Comcast Business detected 4.7 billion phishing attempts, which specifically targeted human error and poor credential hygiene.

Comcast Business•10/1/2025
Cyber threatPhishingInitial access

SCATTERED SPIDER moved from initial access to encryption by deploying ransomware in under 24 hours in one observed case

CrowdStrike•8/4/2025
RansomwareInitial accessEncryption

The top initial access vector observed in 2024 was a tie between exploitation of public facing applications and use of valid account credentials, both representing 30% of X-Force incidence response engagements.

IBM •4/17/2025
Initial accessPublic facing applicationValid account credentials

DirectDefense mapped alerts to the MITRE ATT&CK® framework to identify the top five tactics. The top five tactics identified are: Initial Access, Persistence, Lateral Movement, Execution, and Credential Access.

DirectDefense•4/15/2025
MITRE ATT&CKInitial accessPersistence

For Initial Access, the most observed technique by DirectDefense is Valid Accounts, which involves leveraging stolen credentials for unauthorized access. Alerts triggered for Initial Access include: First Ingress Authentication from Country, Multiple Country Ingress Authentications, Multiple Wireless Country Authentications.

DirectDefense•4/15/2025
MITRE ATT&CKInitial accessValid accounts

Email was the preferred entry vector for cybercriminals, driving 43% of claims.

At-Bay•4/10/2025
EmailCyber attackAttack vector

Browse by Topic

Initial accessDomain controlMore from DirectDefense

Stay Ahead of Cyber Threats

Join 1,000+ security professionals getting weekly insights