13 Minutes to Hack: Positive Technologies Attack Statistics

Positive Technologies experts conducted a series of PT Dephaze assessments across various organizations and found that it takes only 13 minutes to compromise a system or access critical company data. In 60% of cases, attackers managed to gain control over individual hosts, critical applications, or Active Directory.

In 65% of successful attacks, this occurred within the first hour after the intrusion began. The primary tool for lateral movement was credentials: passwords in plaintext were found in 77% of assessments, with the first working logins discovered within minutes.

Statistics show that active accounts were used in 56% of scenarios, authentication redirection in 35%, and vulnerability exploitation in only 6%. Configuration errors were present in 84% of launches, while vulnerabilities accounted for just 38%, confirming that weak settings alone are sufficient for attack progression without exploiting CVEs.

Key sections of the research include an analysis of infrastructure security within the organization, an assessment of defender response time from the start of the attack to threat realization, and an examination of infrastructure shortcomings.

Special attention is given to Windows secret extraction as a stage of attack expansion, the formation of attack paths from individual weaknesses, and practical recommendations for strengthening security.