29 minutes: what the 2026 CrowdStrike Threat Hunting Report tells defenders
CrowdStrike published its 2026 Threat Hunting Report this week, covering July 2025 through June 2026. The headline number is 29 minutes: the average time for an eCrime threat actor to move laterally after initial access. In 2025, that number was 48 minutes. The fastest observed breakout in the current reporting period: 27 seconds.
The numbers
- 29 minutes average eCrime breakout time, down from 48 minutes in 2025. A 40% reduction in one year.
- 82% of detections were malware-free. Adversaries are using valid credentials, trusted authentication flows, and approved SaaS integrations to move across environments.
- One potential intrusion detected every seven minutes across CrowdStrike's telemetry base.
- FAMOUS CHOLLIMA (DPRK-affiliated) scaled insider threat operations using AI-generated personas, placing threat actors in positions at Western technology companies.
- FANCY BEAR (Russia) deployed LAMEHUG, an LLM-powered malware that automates reconnaissance and document harvesting.
- PUNK SPIDER (eCrime) used AI-generated scripts to accelerate credential dumping and delete forensic evidence faster than human operators could.
What the breakout time means in practice
29 minutes is the median. It means that if your detection and response workflow takes longer than 29 minutes from the moment of initial access, you will typically lose the network segment before you can respond.
Most security teams do not have a 29-minute detection-to-containment cycle on lateral movement. Most alerts are triaged in hours, not minutes. The gap between attacker speed and defender response is widening.
The practical implication is not that you need faster analysts. Humans cannot close a 29-minute window consistently. The implication is that you need automated containment that activates on identity anomalies before a human reviews the alert.
The 82% malware-free problem
82% of intrusions used no malware. They used valid credentials, token theft, OAuth abuse, and legitimate admin tools. This breaks most detection strategies that rely on file-based signatures or behavior specific to known malware.
The adversary technique is simple: obtain one set of valid credentials through phishing, credential stuffing, or infostealer markets, authenticate legitimately, then move using native tools. The entire intrusion looks like normal user behavior until you run cross-account correlation.
Countering this requires identity threat detection: baseline what legitimate authentication looks like for each account, flag deviations, and integrate with your containment tooling so that a flagged anomaly results in session revocation, not just an alert.
AI in adversary operations
The report is the first CrowdStrike annual report to document AI as embedded across multiple adversary tradecrafts, not just one or two experiments. The three examples above represent different phases of the attack chain.
AI does not change the objectives; it accelerates execution and scales what would otherwise require human labor. Reconnaissance that took days now takes minutes. Social engineering that required fluent speakers now requires none.
What defenders should do
Automated identity containment: if your SIEM detects an authentication anomaly such as a new geography, new ASN, off-hours access, or impossible travel, it should be able to suspend the session automatically rather than just raising a ticket.
Cross-domain detection: 82% malware-free means your EDR is not the primary detection surface. You need log correlation across identity providers, SaaS platforms, and cloud control planes.
Purple team your breakout scenarios: if you cannot demonstrate that you can contain a lateral movement within 29 minutes in a tabletop exercise, you are not ready for the current threat environment.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss identity-first detection architecture.