The Response Gap: Why the Attacker's Clock and the SOC's Clock No Longer Match

The Response Gap is the difference between how fast an attacker spreads inside a network and how fast a SOC takes its first action. Understanding it starts with reading two clocks.

Breakout time is the time an attacker needs to move from the first compromised system to another. Stop the attack within that window and the damage stays on one endpoint. Miss it and the attack becomes a problem for the whole internal network.

In 2025 the average breakout time was 29 minutes. The fastest case took 27 seconds.

This article reads the attacker's clock through threat reports published in 2026, then reads the SOC's clock the same way. It looks at the difference between the two, why the Response Gap forms, and why hiring more people alone struggles to close it.

1. The attacker's clock: 29 minutes, -7 days, 22 seconds

29 minutes: breakout time - According to the CrowdStrike 2026 Global Threat Report, average eCrime breakout time fell from 48 minutes in 2024 to 29 minutes in 2025, a 65% increase in speed in one year. AI-enabled attacks rose 89% over the same period.

-7 days: time to exploit - Mandiant M-Trends 2026 estimated the mean time from vulnerability disclosure to first exploitation at -7 days. A negative number means attacks begin a week before the patch is released. Vulnerability management built around patch cycles starts behind.

22 seconds: access hand-off - The cybercrime ecosystem runs on specialization. One group gains initial access, and another, such as a ransomware group, takes over for the next stage. The same report found this hand-off fell from more than 8 hours in 2022 to 22 seconds. Steps that once involved negotiation between people now run as an automated pipeline.

Two speeds - In the same report, median dwell time rose from 11 to 14 days. For cyber espionage and North Korean IT worker cases, the median was 122 days, roughly 4 months.

The attacker's clock is splitting in two. Financially driven attacks spread within minutes, and espionage-driven attacks stay quiet for months. A SOC has to answer both.

2. The SOC's clock: from alert to first action

Now read the defender's clock. In most SOCs, an alert moves through this sequence:

Alert → Ticket → Analyst assignment → Triage → Detailed analysis → Action approval → Block or isolate

Each arrow carries waiting time. The alert sits in the queue until the person at one step checks it and passes it on. In one industry survey, respondents said an average of 56 minutes passes before anyone starts acting on an alert. Alert volume keeps rising.

In a 2025 survey, 88% of SOC leaders said alert volume increased over the past year, 76% reported alert fatigue, and 73% reported analyst burnout and staffing shortages.

3. Calculating the Response Gap

Put the two clocks side by side and the Response Gap becomes a number.

With industry averages, 56 minutes − 29 minutes = 27 minutes. For 27 minutes before the first action, the attacker is already moving inside. The gap widens by time of day. If a team takes 56 minutes on weekday hours, nights and weekends, with fewer people working the queue, likely take longer. Attackers do not keep office hours.

4. Will hiring more people close the Response Gap?

Hiring is the first answer most teams reach for. More people means a shorter queue and faster first action. Three factors make hiring alone a hard way to close this gap.

① The right people are hard to find - In its 2025 Cybersecurity Workforce Study, ISC2 did not publish a global workforce gap estimate for the first time, because respondents ranked skills shortages above headcount. Of more than 16,000 respondents, 59% reported critical or significant skills gaps, up from 44% in 2024. 88% said skills shortages led to at least one significant incident. More job postings do not produce more people with the needed skills.

② Headcount grows in proportion. Attacks grow faster. - Double the analysts and throughput at most doubles. In practice, more people bring more hand-offs and coordination, so the gain often falls short of double. Attacks grow through automation. A breakout time that sped up 65% in one year and a hand-off that went from 8 hours to 22 seconds sit on a different curve from headcount growth.

③ 24 hours takes more people than it seems - Accounting for shifts, leave, and training, filling one seat 24/7 typically takes four to five people. Holding night and weekend response times to weekday levels changes the unit of workforce planning.

5. Four ways to narrow the Response Gap

Hiring is still necessary. Alongside it, there are ways to address the structure of the Response Gap directly.

Measure your own clock first

Industry averages are reference points. Take last quarter's alerts that turned out to be real threats and measure the time from alert to first action, split by weekday hours, nights, and weekends. You will see where, and at which step, the gap is widest.

Remove waiting steps

The biggest delay often sits after analysis, while waiting for action approval. For actions with clear criteria, such as isolating an endpoint showing ransomware behavior, a pre-approved playbook removes that wait.

Cover the time-zone gap

If internal staff cannot cover 24 hours, consider handing nights and weekends to a security operations partner, or a structure where teams across time zones pass the shift along.

Automate repetitive work

Threat intelligence lookups, related log collection, and correlation repeat the same way every time and are first in line for automation. The less analyst time goes to this work, the shorter the time to first action.

6. Response Gap checklist for your organization

• In last quarter's real threat cases, how many minutes on average from alert to first action?

• What is that time on weekday hours, nights, and weekends?

• How many people does one alert pass through before first action?

• Are there isolation or blocking actions that can run immediately without approval?

• Is there a process for vulnerabilities exploited before a patch exists?

The attacker's clock moves in minutes and seconds. Many SOC clocks still move in queues and approvals. The first step in narrowing the Response Gap is measuring your own clock accurately. Once the numbers are visible, it becomes clear which step to change. PAGO Networks provides 24/7 security operations and incident response. If you would like to measure your response times with us, get in touch.

References

• CrowdStrike, 2026 Global Threat Report (Feb 2026)

• Mandiant (Google Cloud), M-Trends 2026 (Mar 2026)

• ISC2, 2025 Cybersecurity Workforce Study (Dec 2025)

• Prophet Security, The State of AI in the SOC 2025 (via The Hacker News, Sep 2025)

• 2025 Pulse of the AI SOC Report (via IT Brief, 2025)