CyphrQ
Menu

The Data Breach Lifecycle: From First Access to Notification

How a data breach unfolds, from initial access and dwell time to containment and notification, with 2026 figures from IBM, Mandiant and Verizon.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

12 min read

The data breach lifecycle is the sequence every serious breach follows: an attacker gets in, stays hidden, gains more access, takes data or disrupts systems, and is eventually found, contained and cleaned out, after which the organisation recovers and notifies regulators and the people affected. Each stage leaves evidence and offers a chance to stop it. The earlier you break the chain, the cheaper the breach.

The stages are not tidy. Some attackers steal data within hours of getting in; others wait months. But the order holds often enough that it is the most useful map for planning defences, budgets and drills. This post is the hub for our breach cluster: each stage links to the guide that covers it in depth.

What is the data breach lifecycle?

Think of it as two clocks running at once. The attacker's clock starts at first access. Yours starts when someone notices. The gap between them is where most of the damage happens.

Stage What the attacker does What the defender needs
1. Initial access Gets a foothold: an exploited device, stolen login, phishing, a supplier Patching, strong authentication, supplier controls
2. Dwell time Stays quiet and looks around Logging and someone watching it
3. Escalation and spread Steals credentials, gains admin rights, moves between systems Least privilege, identity monitoring
4. Exfiltration or impact Copies data out, encrypts or destroys systems Egress monitoring, data controls, backups
5. Detection (Hopes you don't notice) Detection tools, a team, a way to escalate
6. Containment and eradication Tries to keep access A rehearsed response plan
7. Recovery Clean rebuilds, tested restores
8. Notification and lessons Legal clocks, records, improvements

Stages 1 to 4 belong to the attacker. Stages 5 to 8 belong to you. Planning that only covers stages 5 to 8 means waiting for the attacker to finish.

How do attackers get in at the start of a data breach?

The two largest breach datasets agree on the top answer for 2025: exploiting a software flaw.

The two reports measure different things (Verizon counts breaches across many contributors; Mandiant counts the intrusions it investigated), so treat each figure as that publisher's view for that year.

Our guides on the common front doors:

What is dwell time, and how long do attackers stay hidden?

Dwell time is the number of days between an attacker's first access and the moment the victim detects them. It measures how long the attacker had to work undisturbed.

Mandiant reports the global median dwell time rose to 14 days in 2025, from 11 days. The median hides a long tail: for cyber espionage and North Korean IT worker cases, "the median dwell time for both categories was 122 days".

IBM measures something related: how long a breach takes to identify and contain. In India, IBM's 2026 report found that organisations not using AI or security automation "took an average of 236 days to identify and 75 days to contain" a breach. With extensive automation, the figures were 175 days to identify and 81 to contain. IBM's global lifecycle figure is not quoted here because it could not be checked on IBM's own pages.

Why do the numbers differ so much? Mandiant's cases are targeted attacks handled by its consultants. IBM's study, run by the Ponemon Institute, covers 602 organisations with breaches between March 2025 and February 2026, and counts to containment, not just detection. Different yardsticks, both useful.

How does a breach escalate from one account to the whole network?

The first foothold is rarely the prize. Attackers want administrator rights, domain controllers, cloud admin consoles and backup systems.

The usual pattern: steal more credentials, use them to log in elsewhere, find where the valuable data and the backups live. Much of this uses the same tools administrators use, which is why it blends in. The living-off-the-land guide shows how built-in tools such as PowerShell carry an intrusion without obvious malware.

Speed varies. Mandiant reports that the median time between an initial access event and its hand-off to a second threat group fell from more than 8 hours in 2022 to 22 seconds in 2025. That is a hand-off between criminal groups, not a full intrusion, but it shows how automated the early stages have become.

When does data exfiltration happen in a breach?

Exfiltration is the unauthorised copying of data out of your environment. In a pure data theft it is the goal. In modern ransomware it often comes before encryption, so the attacker can threaten to publish the data even if you restore from backup.

Exfiltration is detectable in principle: unusual volumes leaving the network, new cloud storage destinations, archive tools running on file servers, large downloads from SaaS apps. In practice, few organisations watch outbound traffic as closely as inbound.

Knowing which data matters is the first defence. Our guide to data classification and data loss prevention covers labelling data and blocking it from leaving. For the extortion stage, the ransomware lifecycle guide explains encryption, double extortion and backups, and the decryption tools guide explains when free decryptors exist.

Who detects a data breach first?

More often than before, the victim does. Mandiant reports that in its 2025 investigations, "52% of the time organizations first detected evidence of malicious activity internally, an increase from 43% in 2024." The rest learned from an outside party, which can be a partner, law enforcement, or the attacker's ransom note.

Detection depends on two things: tools that collect the right signals, and people who look at them. Our comparison of breach detection tools covers EDR, NDR, XDR and the rest. The SIEM vs SOC explainer separates the log platform from the team that runs it. To test whether any of it works before a real attacker does, a red, blue or purple team exercise is the honest check.

What happens in breach containment, eradication and recovery?

Containment stops the bleeding. Eradication removes the attacker. Recovery gets the business running on clean systems.

  1. Contain. Isolate affected machines, disable compromised accounts, block attacker infrastructure. Preserve evidence first where you can: memory, logs, disk images.
  2. Scope. Work out every system and account the attacker touched. Missing one means they come back.
  3. Eradicate. Remove persistence, rebuild compromised systems from known-good images, reset credentials, including service accounts.
  4. Recover. Restore from backups you have checked are clean, bring systems back in priority order, watch closely for re-entry.

The ISO/IEC 27035 explainer lays out how to structure this as a repeatable process. Costs at this stage are what cyber insurance is meant to absorb, and our cyber insurance guide lists which ones a policy typically pays and which it excludes.

What the stage costs is rising. IBM's 2026 report puts the global average cost of a data breach at a record $4.99 million, with reported ransomware incidents up to 39% from 34%. Regionally, IBM puts the Middle East average at $8 million, and India's average at INR 255 million (INR 25.5 crore), an all-time high for that country.

When does breach notification start?

Notification is a legal stage with its own clocks, and most of them start when you become aware of the breach or decide it is serious, not when it began. A long dwell time doesn't extend your deadline.

The last part of this stage is the one most often skipped: a written review of what happened, what worked, and what changes. Without it, the next breach follows the same path.

How does the breach lifecycle map to NIST SP 800-61r3 and CSF 2.0?

NIST rewrote its incident response guidance in April 2025. SP 800-61 Revision 3 is now a CSF 2.0 Community Profile and supersedes the 2012 Revision 2. NIST's announcement says "The six Functions of the NIST Cybersecurity Framework (CSF) 2.0 all play vital roles in incident response."

Here is how I line the lifecycle stages above up against the six CSF 2.0 functions:

Breach lifecycle stage CSF 2.0 function (my mapping)
Before initial access (your defences) Govern, Identify, Protect
Dwell time, escalation, exfiltration (attacker active) Detect
Containment and eradication Respond
Recovery Recover
Notification Respond
Lessons learned Identify, Govern

The whole table is my framing, not NIST's. SP 800-61r3 sets out its own mapping of incident response activities to CSF 2.0, so check the publication itself before you cite a row to an auditor.

Going deeper: for security and IT teams

Threat model per stage. Use MITRE ATT&CK v20's enterprise tactics as the attacker-side vocabulary. Initial access is TA0001. Dwell time spans TA0003 Persistence, TA0005 Stealth, TA0112 Defense Impairment and TA0007 Discovery. Escalation is TA0004 Privilege Escalation, TA0006 Credential Access and TA0008 Lateral Movement. Exfiltration is TA0009 Collection, TA0011 Command and Control and TA0010 Exfiltration. Disruption is TA0040 Impact. Note the current naming: as checked on 26 October 2026, ATT&CK v20 listed TA0005 as Stealth and a separate TA0112 Defense Impairment, and the tactics page no longer used the name "Defense Evasion". Update older detection maps that still use it.

Measure your own clocks. Define four timestamps per incident and record them in the ticket: earliest attacker activity found in evidence (T0), first alert or report (T1), containment complete (T2), eradication confirmed (T3). Dwell time is T1 minus T0, the Mandiant-style metric. Time to contain is T2 minus T1. IBM's identify-plus-contain lifecycle is roughly T2 minus T0. Track medians, not averages, because a single long espionage case skews the mean.

Retention must exceed dwell time. If your logs roll over before an intrusion is found, you can't establish T0, scope the breach or tell a regulator what was taken. Mandiant warns that "With threats like BRICKSTORM achieving dwell times of nearly 400 days, standard 90-day log retention policies leave organizations completely blind to the initial access vector". Its median of 14 days is the typical case; plan retention for the 122-day espionage median and beyond on identity, edge-device and cloud audit logs.

Edge devices are a blind spot. Mandiant names threat clusters, UNC6201 and UNC5807, that deliberately go after VPN appliances and routers, devices where EDR agents usually don't run. Compensate by shipping the device's own logs (authentication, configuration changes, admin sessions) to a central store, by checking firmware integrity against vendor tools, and by watching the network traffic around the device.

Patch windows are shrinking. Mandiant estimates the mean time to exploit vulnerabilities at -7 days, meaning exploitation routinely starts before a patch exists. With Verizon putting exploitation at 31% of breaches, prioritise by known exploitation, not severity score alone. Our guide to CVSS, EPSS and the KEV catalogue covers the method. Where no patch exists yet, reduce exposure: take management interfaces off the internet and restrict who can reach them.

In practice: the cost of the lifecycle. IBM's India figures show the gap automation makes at the identify stage, 236 days without it against 175 with it, while containment stayed around 75 to 81 days. Faster detection did not make containment faster. That is consistent with containment being limited by people and process, not tooling, though IBM's release does not draw that conclusion itself.

Controls by stage, in ISO/IEC 27002:2022 terms. Preparation leans on the organisational and technological controls; detection on logging and monitoring; response on incident management and evidence collection. Our ISO/IEC 27002 controls guide lists them by theme.

What to verify or ask: - For our last three incidents, can we state T0 to T3 from evidence, not memory? - Is log retention on identity, VPN and cloud admin logs longer than 122 days? - Which of our internet-facing devices have no EDR, and what do we collect from them instead? - Who outside the security team can declare an incident and start the notification clock? - When did we last restore a critical system from backup end to end?

Nine steps to prepare for every stage of a breach

  1. List your internet-facing devices and supplier connections. Those are your most likely initial access points.
  2. Turn on and centralise logs from identity, edge devices, endpoints and cloud admin consoles.
  3. Keep those logs for twelve months or more; some regulators demand longer.
  4. Make sure someone reviews alerts every day, in-house or through a provider.
  5. Remove standing admin rights and separate admin accounts from everyday ones.
  6. Know where your most sensitive data lives and watch for it leaving.
  7. Keep offline or immutable backups and test a full restore twice a year.
  8. Write down who declares an incident, who calls legal, and who notifies regulators.
  9. After every incident or exercise, record T0 to T3 and one change you will make.

Key takeaways

  • The data breach lifecycle runs from initial access through dwell time, escalation, exfiltration, detection, containment, recovery and notification.
  • Exploiting software flaws was the top way in for 2025 in both Verizon's DBIR (31% of breaches) and Mandiant's M-Trends (32% of intrusions).
  • Mandiant's global median dwell time was 14 days in 2025, but 122 days for espionage and North Korean IT worker cases.
  • IBM's 2026 report puts the average breach at a record $4.99 million globally and $8 million in the Middle East.
  • NIST's April 2025 SP 800-61r3 rebuilds incident response guidance as a CSF 2.0 Community Profile; NIST says all six CSF 2.0 functions play a role in incident response.
  • Keep logs longer than attackers stay hidden, or you can't scope the breach or tell regulators what was taken.

Sources