THE STAKES — Defense Efficacy Benchmarks
Median Detection Dwell Time
Median — 2025
14 Days
Median detected-incident dwell. Up from 10 days in 2023. Note: IBM's mean time-to-identify across all breach types is 181 days — mean is pulled up by long-tail undetected breaches.
Total Breach Lifecycle
Mean (IBM 2025)
241 Days
181 days to identify + 60 days to contain. 9-year low — but still 8 months of exposure.
Attacker Hand-Off Speed
Median (Mandiant 2026)
22 Sec.
From initial access to ransomware group delivery. Was 8+ hours in 2022. The window to intervene has effectively closed.
AI-Assisted Detection
IBM 2025
51 Days
Detection time with extensive AI/automation vs. 241-day average. $1.9M savings per breach.
Master Matrix — Attack Type × Mapped Defense Technology
Every major attack type mapped to the defense technology(s) that address it, with a coverage rating reflecting how completely that mapping holds up against real-world outcome data. Click any technology name to jump to its full detail card below.
| Attack Type | Mapped Defense Technology(s) | Defense Tech Coverage | Key Data Point |
|---|---|---|---|
| Ransomware | Immutable Backups + MDR + IR Plan/Team | Partial | $375K median recovery cost with intact backups vs. $3M when backups are compromised — Sophos 2025 |
| Phishing / Credential Theft | Email Security Gateway + MFA / FIDO2 | Full | Gateway blocks 93% of phishing & 98.6% of malware; MFA blocks 99%+ of identity-based attacks — Microsoft |
| AiTM (Adversary-in-the-Middle) | FIDO2 / Passkey MFA (phishing-resistant only) | Partial | 79% of BEC/AiTM victims already had standard MFA deployed — bypassed via session-token theft — SafeGuard GRC 2026 |
| BEC (Business Email Compromise) | Email Security Gateway + MFA / FIDO2 + IR Plan/Team | Partial | $2.77B in reported BEC losses — FBI IC3 2024 |
| Supply Chain | Vendor / Third-Party Risk Mgmt | Gap | Third-party breach involvement doubled 15%→30% in one year — largest single-year shift on record; $4.91M avg. cost, 267 days to detect — Verizon DBIR 2025 |
| DDoS | WAF / DDoS Mitigation | Partial | 70% of websites experienced a DDoS attack in 2025 — Indusface |
| Zero-Day / CVE Exploitation | Risk-Based Patching | Gap | Mean time-to-exploit turned negative (−7 days) in 2025 — exploitation now precedes patch availability — Qualys TRU 2026 |
| Lateral Movement | Zero Trust Architecture + Network Monitoring | Partial | Fastest observed lateral movement: 2 min 7 sec; ZTA at 91% Fortune 500 vs. only 52% of all orgs — CrowdStrike / CTI Labs |
| Data Exfiltration | DLP (Data Loss Prevention) | Gap | Prevention rate collapsed from 9% to 3% in 2025 — 97 of 100 exfiltration attempts go unblocked — Picus Security |
| Insecure Remote Access | Secure Remote Access (ZTNA) | Partial | 80% of OT ransomware originates via insecure remote access — Dragos 2025 |
| AI Model / App Attacks | No complete technical fix | Structurally Unresolved | 73% of AI systems show prompt injection exposure; attack success rates 50–84%; no complete fix exists even in frontier models |
| OT / ICS Attacks | OT Network Monitoring + IT/OT Segmentation | Partial | OT ransomware attacks hit record high (+64% YoY); <30% of OT networks globally have adequate visibility — Dragos 2026 |
| Insider Threat / Negligence | Security Awareness Training + UEBA / Insider Risk Analytics | Partial | Insider risk costs organizations $17.4M–$19.5M annually and rising — training and behavioral analytics measurably reduce it, but don't eliminate it — Ponemon 2025/2026 |
Coverage key:
Full mapped defense measurably blocks the large majority of this attack type ·
Partial mapped defense helps materially but leaves a significant real-world gap (adoption, bypass, or scale) ·
Gap mapped defense exists but current outcome data shows it failing more often than it succeeds ·
Structurally Unresolved — reserved for AI model/app attacks specifically: researchers consider prompt injection potentially unsolvable with current LLM architectures, not simply under-defended like the other gap-rated rows.
Attack-Defense Relevance: A Closer Look
Six most financially damaging attack types against nine key defenses, plus AI/automation as a cross-cutting column. Red traces to the Attack/Defense Matrix above; amber is reasoned judgment, not independently sourced data. This is an illustrative subset, not the full 13×16 ranking — and it's necessarily generic: actual priorities depend on your industry, stack, and risk profile (OT/ICS defenses, for instance, are irrelevant without industrial control systems).
| Attack Type | MFA / FIDO2 | Immutable Backups | IR Plan/Team | DLP | Vendor / Third-Party Risk Mgmt | Risk-Based Patching | Security Awareness Training | UEBA / Insider Risk Analytics | AI & Security Automation |
|---|---|---|---|---|---|---|---|---|---|
| Ransomware$2.73M avg. payment | Med |
High |
High |
Med |
Low |
Med |
Med |
Med |
High |
| BEC (Business Email Compromise)$2.77B total losses | High |
Low |
High |
Low |
Low |
Low |
Med |
Med |
High |
| Data Exfiltration97/100 attempts succeed | Low |
Low |
Med |
High |
Low |
Low |
Low |
Med |
Med |
| Supply Chain$4.91M avg. cost | Low |
Low |
Med |
Low |
High |
Low |
Low |
Med |
Med |
| Zero-Day / CVE ExploitationTTE now −7 days | Low |
Low |
Med |
Low |
Low |
High |
Low |
Low |
High |
| Insider Threat / Negligence$19.5M avg. annual cost | Low |
Low |
Med |
Med |
Low |
Low |
High |
High |
Med |
High relevance — traces to a rated pairing in the Attack/Defense Matrix above
Medium relevance — reasoned judgment, not independently sourced
Low / no relevance
Defense Technology Detail — Click a Row to Expand
Characteristics, cost/ROI, usage trend, and effectiveness for each technology referenced in the matrix above. The first 9 are core controls carrying a measured AI-intensity overlay — not a standalone "AI & Security Automation" row, since AI increasingly operates as a force-multiplier within these controls rather than as a separate, independently deployable technology.
AI Factor: how much artificial intelligence and automation contribute to this technology's effectiveness — not a rating of the technology's own quality.
🛰️ MDR — Managed Detection & Response
AI Factor
High
Characteristics
Outsourced 24/7 threat monitoring and active-response service; extends coverage without building an in-house SOC.
Cost / ROI
Contributes to the $1.90M breach-cost savings bucket attributed to AI & security automation deployment (IBM Cost of a Data Breach 2025).
Usage Trend
MDR market projected to reach $15–32B by 2030 (range reflects competing analyst methodologies).
Effectiveness
3-day median detection for MDR-monitored ransomware incidents vs. 9-day internal-detection average and 25-day external-notification average; 22 days faster than in-house IR (Sophos Active Adversary Report 2025 / Expert Insights).
🔐 Zero Trust Architecture (ZTA)
AI Factor
High
Characteristics
Security model requiring continuous verification of every user and device — no implicit trust inside the network perimeter.
Cost / ROI
$1.76M in avg. breach-cost savings vs. no ZTA deployed (IBM Cost of a Data Breach 2025).
Usage Trend
91% of Fortune 500 have deployed ZTA vs. only 52% of all organizations (CTI Labs 2025).
Effectiveness
28 days faster breach detection (IBM 2024); 68% insider-threat reduction and 76% successful-breach reduction (ZeroThreat.ai).
🩹 Risk-Based Patching / Vuln. Mgmt
AI Factor
High
Characteristics
Prioritizes remediation around the small subset of CVEs that are both remotely exploitable and actively weaponized (CISA KEV list + CVSS context), instead of patching everything.
Cost / ROI
Avoids the resourcing drain of broad, unprioritized patch programs.
Usage Trend
Now the industry-standard approach, replacing blanket manual patch cycles.
Effectiveness
Mean time-to-exploit turned negative (−7 days) in 2025 — exploitation now precedes patch availability; 63% of critical CVEs remain unpatched by day 7 without prioritization, and 88% of weaponized CVEs were patched only after already being exploited (Qualys TRU 2026).
📋 IR Plan + IR Team
AI Factor
Medium
Characteristics
Documented breach detection/containment/recovery procedures (IR Plan) paired with dedicated staff or a retainer to execute them (IR Team).
Cost / ROI
$1.49M in avg. breach-cost savings vs. no tested plan/team (IBM Cost of a Data Breach 2025).
Usage Trend
OT-specific IR planning still lags IT — most orgs rely on IT-centric playbooks that don't account for OT/ICS safety systems.
Effectiveness
An OT-specific IR plan delivers the single largest measured OT risk reduction of any control (18%, Dragos & Marsh McLennan 2025); OT incidents take 5× longer and cost 11.3× more to resolve without one (e2e-assure 2026).
🔑 MFA / FIDO2 (Phishing-Resistant)
AI Factor
Medium
Characteristics
Multi-factor authentication; FIDO2/passkey hardware-bound credentials resist the session-token theft that defeats SMS/OTP-based MFA.
Cost / ROI
$460K in avg. breach-cost savings vs. no MFA (IBM Cost of a Data Breach 2023 edition).
Usage Trend
70% overall workforce MFA adoption (Okta 2025); <30% of small businesses have full MFA (Duo Security 2024).
Effectiveness
Blocks 100% of automated bot attacks and 99%+ of identity-based attacks (Google Research / Microsoft DDR 2025) — but 79% of BEC/AiTM victims already had standard MFA deployed when compromised (SafeGuard GRC 2026); only FIDO2/passkeys resist the bypass.
🏭 OT Network Monitoring
AI Factor
Medium
Characteristics
Visibility tooling for OT/ICS traffic, device activity, and protocol-aware communications.
Cost / ROI
16% OT financial/insurance risk reduction (Dragos & Marsh McLennan 2025).
Usage Trend
Fewer than 30% of OT networks globally have adequate visibility/monitoring in place (Dragos 2026).
Effectiveness
Average OT dwell time drops from 42 days (no visibility) to 5 days (with visibility) — an 8.4× improvement in response speed.
📡 Network Monitoring (IT)
AI Factor
Medium
Characteristics
Continuous traffic and log analysis to flag anomalous activity before it escalates.
Cost / ROI
Underpins internal detection, which now runs 9 days median vs. 25 days for external notification (Mandiant M-Trends 2026).
Usage Trend
AI/automation's share of breach detections rose from 33% (2023) to 50% (2025) (IBM Cost of a Data Breach).
Effectiveness
52% of breaches are now caught internally, up from 43% in 2024 — but nearly half of orgs still learn of a breach from an outside party or the ransom note itself.
🌐 Secure Remote Access (ZTNA / Jump Servers)
AI Factor
Low
Characteristics
Replaces flat, always-on VPN access with per-session, auditable access — ZTNA brokers connections per-request; jump servers create a logged chokepoint for OT/ICS access.
Cost / ROI
12% OT financial/insurance risk reduction (Dragos & Marsh McLennan 2025).
Usage Trend
ZTNA has reached parity with legacy VPN at 48% adoption each; jump servers sit at 35% (Ponemon/Cyolo 2024). 79% of orgs still run 2+ non-enterprise remote access tools simultaneously.
Effectiveness
80% of OT ransomware originates via insecure remote access — the single largest identified OT entry vector (Dragos 2025).
🧱 IT/OT Segmentation
AI Factor
Low
Characteristics
Network separation that isolates OT/ICS control systems from the corporate IT environment.
Cost / ROI
17% OT financial/insurance risk reduction — the second-highest of the five measured OT controls (Dragos & Marsh McLennan 2025).
Usage Trend
56% of OT organizations report their IT security tools still can't see into the OT layer below (the "boundary blind spot") — segmentation exists but visibility across it doesn't (Dragos 2026).
Effectiveness
Combined with the other four measured OT controls, cumulative risk reduction exceeds 78%.
💾 Immutable Backups
Characteristics
Write-once, tamper-proof backup copies stored so ransomware can't encrypt, delete, or modify them after capture.
Cost / ROI
Roughly $25K–75K/year for a mid-market implementation.
Usage Trend
Adoption accelerating as ransomware groups increasingly target backup infrastructure directly before deploying encryption payloads.
Effectiveness
$375K median recovery cost when backups remain intact vs. $3M when backups are compromised — an 8× cost multiplier (Sophos).
🚫 DLP — Data Loss Prevention
Characteristics
Monitors and blocks unauthorized movement of sensitive data out of the organization, across endpoints, network, and cloud channels.
Cost / ROI
Not consistently reported across public sources.
Usage Trend
Only 16% of organizations have a fully established DLP program (Fortinet 2025).
Effectiveness
Only 47% of organizations report their DLP is effective at stopping data loss (Fortinet 2025); the broader exfiltration-prevention rate collapsed from 9% to 3% in 2025 — 97 of 100 exfiltration attempts now go unblocked (Picus Security).
📧 Email Security Gateway
Characteristics
Filters malicious email at the perimeter — before it reaches an inbox — screening for malware, phishing links, and spoofed senders.
Cost / ROI
Not consistently reported across public sources.
Usage Trend
A near-universal baseline control across enterprise environments.
Effectiveness
Microsoft Defender blocks 98.6% of malware and 93% of phishing attempts at the gateway level.
🌊 WAF / DDoS Mitigation
Characteristics
Web application firewall filters malicious HTTP traffic; DDoS mitigation absorbs or redirects volumetric floods before they reach origin infrastructure.
Cost / ROI
Not consistently reported across public sources.
Usage Trend
Deployment rising in step with attack volume, particularly for internet-facing services.
Effectiveness
70% of websites experienced a DDoS attack in 2025 (Indusface) — the defense category is mature, but attack frequency is outpacing adoption at many smaller organizations.
🤝 Vendor / Third-Party Risk Management
Characteristics
Due diligence, contractual security requirements, and continuous monitoring applied to vendors, suppliers, and other third parties with system or data access.
Cost / ROI
Not consistently reported across public sources.
Usage Trend
Not consistently reported across public sources.
Effectiveness
Only 39% of organizations rate their third-party risk mitigation as highly effective, even as third-party breach involvement doubled from 15% to 30% in a single year — the largest single-year shift on record (Verizon DBIR 2025); those breaches average $4.91M and take 267 days to detect.
🎓 Security Awareness Training
AI Factor
Low
Characteristics
Ongoing phishing simulation and security education to reduce employee susceptibility to social engineering.
Cost / ROI
$12–36 per employee annually for most platforms; delivers roughly 4:1 ROI on average.
Usage Trend
Baseline phishing susceptibility sits around 33.1% without training, dropping to roughly 5% after 12 months of regular simulation (KnowBe4, 67.7M simulations).
Effectiveness
Cuts successful phishing by 50–70% within 12 months (SANS 2025 Security Awareness Report).
🕵️ UEBA / Insider Risk Analytics
AI Factor
High
Characteristics
Behavioral analytics that establish a normal activity baseline per user and flag anomalous access patterns before they escalate into an incident — catches negligent and malicious insiders alike.
Cost / ROI
$150K–3M implementation cost, 3–18 month deployment depending on vendor.
Usage Trend
62% of organizations now favor behavior-based tools over legacy rule-based monitoring for insider threat detection (Ponemon 2025).
Effectiveness
Reduces average insider incident cost from $17.4M to $5.2M annually (Ponemon 2025) — a real, measured reduction, not a marketing claim.
A note on EDR, XDR, and SIEM: all three have measurable market-size and adoption data (e.g. XDR's ~55-day detection-speed improvement over siloed SIEM+EDR, IBM 2025), but current public reporting for these categories skews toward market-sizing rather than the rigorous security-outcome measurement used for the technologies above — so they're referenced here for context, not promoted to full matrix/detail rows. EDR (Endpoint Detection & Response): monitors individual endpoints for threats and enables rapid containment. XDR (Extended Detection & Response): unifies detection across endpoints, network, email, and cloud. SIEM (Security Information & Event Management): aggregates and analyzes log data across the environment to surface anomalies.
Quick-Start Shopping Guide
Cost and effectiveness figures below are pulled from the Technology Detail cards above. Cost data available for 6 of 14 technologies — this is a partial view, not a full ranking. The other 8 (MDR, IR Plan/Team, Vendor/Third-Party Risk Mgmt, DLP, OT Network Monitoring, IT/OT Segmentation, Secure Remote Access, Network Monitoring) lack comparable cost data and are excluded here rather than guessed at.
Cost vs. Protection Value
Bubble size = number of attack types each technology covers in the Master Matrix above
ESG — Email Security Gateway (Low cost / High protection / 2 attack types)
MFA — MFA / FIDO2 (Medium cost / High protection / 3 attack types)
BKUP — Immutable Backups (Medium cost / High protection / 1 attack type)
ZTA — Zero Trust Architecture (High cost / Medium protection / 1 attack type)
WAF — WAF / DDoS Mitigation (Low cost / Medium protection / 1 attack type)
PTCH — Risk-Based Patching (Low cost / Low protection / 1 attack type)
SOURCES ·
Mandiant M-Trends 2026 ·
IBM Cost of a Data Breach 2025 ·
Verizon DBIR 2025 ·
Sophos Active Adversary 2025 ·
CrowdStrike Global Threat Report 2025 ·
Microsoft Digital Defense Report 2025 ·
Dragos OT Year in Review 2026 ·
Claroty CPS Security 2025 ·
Qualys TRU 2026 ·
Edgescan VSR 2025 ·
SafeGuard GRC 2026 ·
IBM AI Breach Report 2025 ·
Fortinet State of DLP 2025 ·
Indusface DDoS Statistics 2025 ·
Picus Security Blue Report 2025 ·
FBI IC3 2024