It Takes Less Than a Day for Attackers to Reach Active Directory—Companies' Most Critical Asset The Vast Majority of Ransomware Attacks Occur Outside of Business Hours Sophos, a global leader in innovating and delivering cybersecurity as a service, today released its Active Adversary Report for Tech Leaders 2023, an in-depth look at attacker behaviors and tools during the first half of 2023. After analyzing Sophos Incident Response (IR) cases from January to July 2023, Sophos X-Ops found that median attacker dwell time—the time from when an attack starts to when it's detected—shrunk from 10 to eight days for all attacks, and to five days for ransomware attacks. In 2022, the median dwell time decreased from 15 to 10 days. In addition, Sophos X-Ops found that it took on average less than a day—approximately 16 hours—for attackers to reach Active Directory (AD), one of the most critical assets for a company.