Inside the Modern SOC: The 72-Minute Race

Unit 42 describes a trend of identity-driven, high-speed attacks where adversaries leverage compromised credentials, MFA manipulation, and rapid privilege escalation to move from initial access to data exfiltration or ransomware deployment in minutes to hours; the report emphasizes the operational “speed gap” in SOCs and recommends automated correlation, parallel enrichment, and predefined containment to close it.