Twenty-Five Minutes

In May 2025, Palo Alto Networks' Unit 42 published the result of an experiment. Using AI at every stage of the attack chain, it simulated a ransomware operation from initial compromise to data exfiltration in 25 minutes. Its own framing was blunt: "That's a 100x increase in speed, powered entirely by AI."

The 25 minutes is the number that gets quoted, and it is the less important half of the result.

The important half is what the exfiltration agent did when a control worked. In Unit 42's description: "When the channel is blocked midtransfer, it self-prompts, switches to embedding data in outbound OneDrive syncs, and resumes."

Read that sentence again from the defender's side

A control fired. It was the right control, it caught a live exfiltration in progress, and it stopped that channel. By every conventional measure it worked.

The agent then re-planned without being asked, moved the data into traffic that looks like ordinary corporate file syncing, and carried on. No operator was woken. No second tool was needed. The gap between the block and the workaround was the time it takes a model to produce a few hundred tokens.

Defensive architecture has never assumed controls hold. It assumes something weaker and entirely reasonable: that a control which fires buys time. That is the assumption underneath the whole response function, from alert routing to escalation tiers to what counts as an acceptable on-call rotation. It is why "we detected it and contained it" is a sentence that normally means something.

What the simulation demonstrated is not a control failing. It is a control succeeding and purchasing nothing.

The lab number stopped being hypothetical

It would be easy to file a 2025 red-team exercise under interesting-but-staged. The following February, Unit 42 published its 2026 Global Incident Response Report, drawn from more than 750 major incidents across over 50 countries. It reports that "in the fastest cases we investigated, attackers needed just 72 minutes to move from initial access to data exfiltration, 4X faster than last year."

Seventy-two minutes is not 25. But it is real rather than simulated, it is a fourfold acceleration in a single year, and the direction of travel between the laboratory bound and the observed floor is only going one way.

The same report notes that "identity weaknesses played a material role in nearly 90% of our investigations," with attackers logging in using stolen credentials and tokens rather than exploiting vulnerabilities. That detail matters later.

What organisations believe about themselves

Set the trend against how prepared people say they are. In a survey of more than 900 security leaders reported in Veeam's Data Trust and Resilience Report, 90 percent said they were very or extremely confident they could meet their defined recovery time objectives. Sixty-nine percent said those objectives were fully aligned with business continuity goals.

Now set it against what happened to those actually tested. Among organisations that suffered an incident in the previous twelve months, more than 40 percent reported customer or service disruption, 41 percent reported financial loss or revenue impact, and 38 percent experienced extended downtime of critical systems. For ransomware specifically, only 28 percent fully recovered all affected data, and 29 percent ended with loss, downtime or disruption they could not undo.

Ninety percent confident. Twenty-eight percent whole.

Confidence is being reported as though it were evidence

Reading that gap as overconfidence is true and not very useful. The more precise reading is that most organisations have never produced the evidence that would let them hold a calibrated view at all.

A recovery time objective is a target. It becomes a capability only once somebody has restored the systems in question, from the backups that actually exist, using the runbook as written, with the staff who would really be on shift, inside the stated window. Short of that, the figure in the continuity plan rests on four separate assumptions: that the backup jobs completed, that the data is intact and restorable, that the procedures are current, and that people can execute them under pressure.

Each is individually plausible. The chance that all four hold at once, never having been checked, is not the number anyone imagines. A plan that has never failed in rehearsal has not been shown to work. It has been shown never to have been rehearsed.

Why the speed changes the arithmetic rather than the advice

While intrusions unfolded over days, an untested recovery plan was a survivable risk. There was room to find the gap during the incident and improvise around it, because the adversary was also improvising, also sleeping, also waiting on a human being.

At machine speed the slack disappears from one side only. The attack re-plans in the time an alert takes to route. The defence still has to wake somebody, convene a call, find the runbook, and discover on the call that it references a system decommissioned in March.

So recovery has quietly moved from being the fallback to being the primary defence, without a matching move in where the evidence sits. Prevention budgets still buy real value. They simply buy less of the specific thing they used to buy, which was time.

What would actually change the position

Boards are shifting from mean time to detect toward mean time to recover, which is the right direction. The useful discipline is narrower than a metric.

Start with identity, and note that this is now an evidenced priority rather than a preference: if identity weaknesses are material in nearly nine of ten investigated incidents, then the identity provider is both the most likely entry point and the system every other recovery depends on. Restoring a database into an environment where nobody can authenticate is not a recovery.

Then take the systems everything else rests on, which in most organisations means identity, the primary databases, and whatever runs the money. Restore them from backup into an isolated environment, on the clock, using the current runbook and people who have not seen the exercise in advance. Record the real elapsed time and compare it with the published objective. Do it before anyone certifies that objective in a filing or an insurance application.

The exercise is unglamorous, it costs a weekend, and it is the only thing that turns a target into a fact. Everything else, including a 90 percent confidence reading from a room of experienced people, describes what an organisation believes rather than what it can do.

An agent needed 25 minutes in a laboratory and routed around the one control that stopped it. Real attackers are at 72 and moving four times faster than they were a year ago. The reasonable question on Monday is not whether the perimeter would hold. It is how long the restore takes, and whether anybody in the building has ever actually measured it.

Sources

• Sam Rubin, Palo Alto Networks Unit 42, "Unit 42 Develops Agentic AI Attack Framework", 14 May 2025. Source for the simulated ransomware attack completed from initial compromise to data exfiltration in 25 minutes, for the quoted characterisation of that as a 100x increase in speed, and for the exfiltration agent's behaviour on being blocked, quoted verbatim: "When the channel is blocked midtransfer, it self-prompts, switches to embedding data in outbound OneDrive syncs, and resumes." This was a controlled simulation by a vendor with a commercial interest in the finding, and it is treated here as a demonstration of what is possible rather than as a measurement of what is typical.
• Palo Alto Networks Unit 42, 2026 Global Incident Response Report, 17 February 2026, drawn from more than 750 major incidents across over 50 countries. Source for "in the fastest cases we investigated, attackers needed just 72 minutes to move from initial access to data exfiltration, 4X faster than last year," and for "identity weaknesses played a material role in nearly 90% of our investigations." The full report is published separately.
• Veeam, Data Trust and Resilience Report, as reported in "2026 Cyber Resilience Trends: Where Confidence Meets Reality". Source for the survey of more than 900 security leaders, the 90 percent confidence and 69 percent alignment figures, the incident outcomes over the previous twelve months, and the ransomware recovery figures of 28 percent fully recovered and 29 percent left with damage they could not undo. These reach us through that secondary account rather than from the report read directly, and the survey's field dates are not stated there.