This is a one-page plan for the moment you suspect a machine or an account has been taken over. It covers what to do in the first 15 seconds, the data on why the window is that short, and what your team needs in the minute after you call.
average time for an eCrime intruder to move sideways, 2025
CrowdStrike, 2026 Global Threat Report; 65% faster than 2024
fastest observed breakout
CrowdStrike, 2026 Global Threat Report
to the start of data exfiltration in one intrusion
CrowdStrike, 2026 Global Threat Report
Fifteen seconds is too short for one person to deal with an incident. It is long enough to stop the spread, lock the door behind you and get a trained team on the line.
Do not hold the power button or pull the plug.
Shutting down wipes memory, which holds the traces an investigator needs to identify the malware.
This stops ransomware reaching other machines and stops data leaving, and it costs one cable.
Do not log in from the affected machine.
If the machine is compromised, a keylogger or session thief sees the new password too.
Identity weaknesses played a material role in nearly 90% of the investigations in Unit 42's 2026 report.
DEVICE: [device or system name] SEEN: [what you see, for example a ransom note on screen] DONE: Network unplugged at [time]. Power left on. Accounts reset from my phone.
These figures measure different things and come from different reports, so read each label. All of them sit on one logarithmic time axis: each gridline is a multiple of the one before.
The 15-second plan on this page.
Fastest observed eCrime breakout in 2025. CrowdStrike, 2026 Global Threat Report.
In one intrusion, data exfiltration began within four minutes of initial access. CrowdStrike, 2026 Global Threat Report.
Average eCrime breakout time in 2025, 65% faster than 2024. CrowdStrike, 2026 Global Threat Report.
In the fastest cases investigated, 72 minutes from initial access to exfiltration, four times faster than the year before. Palo Alto Networks, 2026 Unit 42 Global Incident Response Report.
Sources: CrowdStrike, 2026 Global Threat Report (breakout, first exfiltration); Palo Alto Networks, 2026 Unit 42 Global Incident Response Report (fastest-case exfiltration). As of 2 October 2026.
Once the team is on the line, the clock is still running. They need four facts about the thing in front of them, in seconds, with a source for each. Here is why the usual ways of getting them are slow.
| The question | Live web crawl | Plain RAG | A structured reference graph |
|---|---|---|---|
| Is this vulnerability being exploited right now? | The answer sits on a government catalogue page. Fetching and parsing live pages under a deadline depends on someone else's server. | A retrieved passage may be a blog post from before the exploitation started. | A single lookup that returns the date it entered the exploited-vulnerability catalogue and its due date. |
| Which attack technique does it enable? | Technique pages are written for people. Matching a CVE to a technique across several sites is a research task. | Chunks of text carry no relationships, so the link between CVE, weakness and technique is guessed by the model. | A stored link that says which source stated it, or that we inferred it. |
| What already detects it? | Detection rules live in separate repositories with different formats. | Similar-looking rule text comes back, not the rules mapped to this technique. | Detection rules from several public rule sets, linked to the technique. |
| What does the response look like? | Playbooks are PDFs and wiki pages. | A procedure comes back with no link to the detection that triggered it. | A link from a detection to the procedure that handles it, where one exists. |
The answer sits on a government catalogue page. Fetching and parsing live pages under a deadline depends on someone else's server.
A retrieved passage may be a blog post from before the exploitation started.
A single lookup that returns the date it entered the exploited-vulnerability catalogue and its due date.
Technique pages are written for people. Matching a CVE to a technique across several sites is a research task.
Chunks of text carry no relationships, so the link between CVE, weakness and technique is guessed by the model.
A stored link that says which source stated it, or that we inferred it.
Detection rules live in separate repositories with different formats.
Similar-looking rule text comes back, not the rules mapped to this technique.
Detection rules from several public rule sets, linked to the technique.
Playbooks are PDFs and wiki pages.
A procedure comes back with no link to the detection that triggered it.
A link from a detection to the procedure that handles it, where one exists.
Always check the snapshot date before acting on an answer from any reference source.
Lattice is a read-only MCP server over a cybersecurity knowledge graph: CVEs, ATT&CK techniques, weaknesses, threat actors, detections and response procedures. Each link says which source stated it and whether it was stated or inferred. There is no model in the path and no write tool, so a lookup does one thing and returns.
Median tool time is under 100 ms for every tool. The slowest median we measured is 17.8 ms, so the claim leaves room for your network and for slower days.
Measured 30 September 2026. Full MCP round trip, median of 200 sequential calls per case, measured on the same host as the server. It is not the hosted service over a network; add your own round trip.
for a three-call enrichment of one CVE (4.1 + 5.9 + 10.4).
of the 15-second window. The rest is left for reasoning.
graph_lookup id=CVE-…4.1 msgraph_path template=cve-to-defense5.9 msgraph_path template=technique-coverage10.4 msLast verified 2 October 2026. Attack-speed figures are quoted from the publishers named above. This page gives general guidance; follow your organisation's own incident plan where it differs.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.
Talk to us