On average how long does it take for a business to detect a data breach?
In an IBM study in 2019 which looked at 507 companies and interviewed 3211 individuals in companies that had experienced a data breach in the last year, it identified that the average time to identify a breach in 2019 was 206 days. In a similar 2020 IBM study, the average time to identify a breach was 207 days.
I surveyed some cybersecurity professionals to estimate what they estimated the average, the results were interesting a number got the average time reasonably correct however a significant number overestimated the average detection capability in organisations. It will be interesting to see if this number stays static or will move in either direction as organisations mature their cybersecurity capabilities and attackers adapt to cover their tracks better.