72 Minutes to Exfiltration: Why SOCs Must Now Operate at Machine Speed

The 72-Minute Number, In Context

On February 17, 2026, Palo Alto Networks’ Unit 42 published its 2026 Global Incident Response Report, drawing on over 750 major cyber incidents across more than 50 countries. The headline metric is blunt: in the fastest cases investigated, attackers moved from initial access to data exfiltration in just 72 minutes — four times faster than the same metric a year earlier.

Breakout time — the interval between initial compromise and measurable impact — has been steadily compressing for a decade. CrowdStrike’s annual report tracked it from hours in 2019 to minutes in 2023. Unit 42’s 2026 data confirms the acceleration is now exponential, not linear, and attributes it primarily to attackers’ operational use of AI for reconnaissance, phishing content generation, script authoring, and lateral movement automation.

For defenders, the implication is direct. If adversaries can complete the kill chain in 72 minutes, a Security Operations Center (SOC) that detects and triages alerts on a human schedule — shifts, queues, tickets — has already lost before the on-call analyst reads the page.

Where the 750 Incidents Broke

The Unit 42 report’s finding set is dense with specific, defensible numbers. Five stand out:

• Nearly 90% of investigations involved identity weaknesses as a material factor. Compromised credentials, MFA fatigue, OAuth token abuse, and session hijacking are now the dominant initial access category.
• 87% of intrusions involved activity across multiple attack surfaces. Single-product detection tools miss the majority of intrusions because attackers chain endpoint, identity, cloud, and SaaS activity.
• Nearly 48% of incidents included browser-based activity. The browser has become the workplace — and the attack surface.
• 23% of incidents involved third-party SaaS application exploitation. The Vercel/Context.ai breach disclosed two months after this report is a textbook example.
• Over 90% of incidents featured misconfigurations or security coverage gaps. The vulnerability was not the absence of tools but the mis-deployment of tools that were already purchased.

One positive trend: a 15% decline in encryption-based extortion compared to the prior year, as organizations shift toward data-theft extortion where encryption is skipped in favor of leak threats. This does not make breaches less damaging — it makes them faster.

What “Machine Speed” Actually Means for a SOC

“Machine speed” is not marketing language for buying more tools. It is a specific operating model with measurable properties:

Detection in seconds, not minutes. Correlation rules that fire when a single identity signal appears anywhere in the environment — a new OAuth grant, an impossible-travel login, a token issuance from an unrecognized app — must run in streaming pipelines, not batch queries. A 15-minute SIEM aggregation window is already longer than the fastest attack’s dwell time.

Automated response for known patterns. When a Tier-1 alert matches a known-bad pattern (impossible travel + privilege elevation + download volume), the response — session revocation, token invalidation, credential reset — must fire automatically. Waiting for an analyst to click “approve” is waiting past the 72-minute window.

Identity as the telemetry backbone. Given that nearly 90% of Unit 42 cases involved identity weaknesses, identity events — not endpoint events — must be the primary signal. This means Azure AD / Entra ID, Okta, and Google Workspace logs ingested in real time with behavioral baselining, not quarterly compliance review.

Cross-surface correlation by default. With 87% of intrusions crossing surfaces, any SOC that analyzes endpoint, cloud, and SaaS data in separate consoles will miss the majority of attacks. XDR or SIEM platforms must unify these streams — and more importantly, analyst workflows must follow threats across surfaces rather than triaging by tool queue.

Detection engineering as a permanent function. The detection library has to evolve weekly as attacker TTPs shift. This requires a dedicated detection engineering role, not a rotation of on-call analysts writing rules between incidents.

The Gap Between the Report and Most SOCs

The uncomfortable part of the Unit 42 data is the gap between what it describes and what most SOCs actually run. Industry surveys from 2025 consistently show that the median mid-market SOC still operates with:

• A SIEM with 15-30 minute aggregation windows
• Endpoint detection and identity logs in separate consoles
• Manual analyst triage for most Tier-1 and all Tier-2 alerts
• Quarterly or ad-hoc detection rule updates
• Response automation limited to specific use cases approved by change management

Closing this gap is not a single tool purchase. It is a multi-quarter program involving platform consolidation, automation playbook authoring, identity telemetry enrichment, and detection engineering staffing. Organizations that start this program in 2026 are already behind the attack curve; those that have not started it by 2027 should expect breach outcomes that match the Unit 42 averages.

A Practical Q2 2026 Priority List

For SOC leaders reading the Unit 42 report as a call to action, five priorities dominate the next 90 days:

1. Measure current MTTD and MTTR against the 72-minute benchmark. If detection alone takes longer than 72 minutes, response automation will not rescue the timeline.
2. Instrument OAuth and identity events end-to-end. Ensure every OAuth consent, token issuance, and cross-tenant authentication is logged and baselined.
3. Consolidate endpoint, identity, and SaaS telemetry into a single query surface. If analysts are pivoting between four consoles, attackers will outrun them.
4. Automate session and credential revocation for the top five high-confidence detection patterns. The rest can stay manual while automation trust is built.
5. Staff detection engineering as a dedicated function. The attack landscape moves weekly; so must detection content.

The 72-minute number is not a future threat. It is what Unit 42 observed across 750 incidents in the year that just ended. SOCs that build for it now are preparing for the median, not the worst case.

Sources & Further Reading

• 2026 Unit 42 Global Incident Response Report — Palo Alto Networks
• 2026 Unit 42 Global Incident Response Report: Attacks Now 4x Faster — Palo Alto Networks Community
• 2026 Unit 42 Global Incident Response Report Coverage — Strategic Focus
• 5 Predictions That Will Redefine Your SOC in 2026 — Security Boulevard