Skip to content
Range Compare

The Range Desk · Note

M-Trends 2026 and the case for training detection, not only response

Short answer

Mandiant's M-Trends 2026 reports a 14-day median dwell time, up from 11, while the share of intrusions found internally rose to 52%. Detection is improving for some and slipping for others. Training that only rehearses the response after detection misses the stage where many incidents are won or lost.

By The Range Desk · Cyber Range Compare · Published 2026-09-30

Desk research from public vendor, standards and regulator pages read on 27 September, 11 October and 13 October 2026. Profiles follow our published method; we did not run the products.

4 min readCyber rangeResearch

Sources: dated 23 March 2026, with vendor pages read 27 September 2026.

Every year Mandiant's M-Trends report gives the security industry a few numbers to argue about. The 2026 edition, published on Google Cloud's threat intelligence blog on 23 March 2026, has several that matter for anyone deciding how to train a SOC.

What did M-Trends 2026 report?

  • The global median dwell time, the time an attacker spends in an environment before being found, was 14 days, up from 11 the year before.
  • 52% of intrusions were first detected internally in 2025, against 43% in 2024.
  • Exploits were the most common initial infection vector for a sixth year, at 32%. Voice phishing accounted for 11%.
  • Prior compromise was the top vector for ransomware, at 30%.
  • The report describes a hand-off window of 22 seconds, and a dwell time of 122 days for espionage and North Korean IT worker activity.

How can dwell time rise while internal detection improves?

The two numbers measure different things. More organisations are finding intrusions themselves rather than being told by a third party, which is good. But the median time to find them got longer. One reading is that detection capability is spreading unevenly: some teams detect earlier and on their own, while long-running intrusions, such as the 122-day espionage cases, pull the median up.

For training, the useful point is that detection is a skill with a wide spread between teams. That is exactly the kind of gap labs and ranges are built for.

What does this mean for SOC training?

Many training programmes, especially exercises, start at the moment an incident is declared. The tabletop begins with a ransom note; the range scenario begins with an alert already firing. That rehearses the response well and the detection hardly at all.

A programme that takes the M-Trends numbers seriously would add three things:

  • Labs on the investigation skills that shorten dwell time: hunting through logs, spotting persistence, following lateral movement. Threat hunting simulators, such as the one TryHackMe lists, sit here.
  • Range exercises that begin quietly, before any obvious alert, so the team has to notice something is wrong. A range that runs against your own tools, as Immersive Labs describes for its Dynamic Threat Range, tests your actual detections rather than a generic set.
  • Exercises built around the leading vectors. If exploits and prior compromise lead the list, scenarios should start there, not only with phishing.

What about the 22-second hand-off?

The report's hand-off window figure is a reminder that attackers move between stages quickly. On the defensive side, the equivalent is the hand-off between analyst, shift lead and incident commander. That is a team skill, tested in a range, and at the boundary with business decisions, tested in a crisis exercise. Cyberbit's Crisis Sim 360, for example, describes technical escalations that trigger executive decisions in the same exercise.

Does incident response guidance say the same?

Broadly. NIST SP 800-61 Revision 3, published in April 2025, treats incident response as part of cybersecurity risk management across the Cybersecurity Framework 2.0 functions, including detection, rather than as a process that starts once an incident is declared. Training that covers detection fits that framing better.

What should a SOC lead do with this?

Check your own dwell time and detection source for the last few incidents against the M-Trends figures. If your numbers look like the long tail, put the next training money into detection: lab paths on hunting and investigation, and at least one range exercise a year that starts before the alert. If your detection is fast and the delay came later, the crisis simulation guide is the better next read.

What about teams without a range budget?

Detection skill can still be trained. Lab paths on investigation and hunting are cheap and often start free, and a quiet-start scenario can be run as a tabletop with the SOC: describe the early signs and ask the team what they would look at, in what order, and when they would escalate.

The cyber range guide lists which platforms sell a team range and on what terms.

Sources