M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds

Google on Monday published the M-Trends 2026 report, which is based on information collected by its Threat Intelligence Group and insights from more than 500,000 hours of incident investigations conducted by Mandiant in 2025.

One of the most notable findings of the industry benchmark report is that the time between initial access to an organization’s systems and the handoff to a secondary threat group has decreased from hours to seconds over the past few years.

In 2022, the median time between initial access and the handoff exceeded 8 hours, but it has steadily decreased since 2023, reaching only 22 seconds in 2025.

Mandiant researchers believe this indicates a “closer collaboration between initial access partners and secondary groups”.

They also noted that in many cases the short time window can be the result of an automated process where initial access brokers deliver malware directly on behalf of the secondary ...