Mandiant Report Reveals 22-Second Ransomware Hand-Off in Public Sector Attacks

Mandiant's 2026 Public Sector Threat Landscape report reveals that the median time between an initial access broker establishing a foothold and handing off to a ransomware operator has compressed to just 22 seconds. The report, based on over 500,000 hours of incident investigations from 2025, highlights that public sector organizations now face adversaries operating at machine speed, defending a complex web of interconnected trust relationships rather than a traditional perimeter. This extreme acceleration of the attack cycle underscores the need for automated, real-time threat response capabilities. The findings are tailored to mission-critical public sector leaders, emphasizing the urgency of adapting cybersecurity strategies to counter rapidly evolving threats.

Global Impact

The report's findings have significant implications for national security and critical infrastructure protection. Governments worldwide will likely accelerate adoption of zero-trust architectures and machine-speed defense mechanisms, driving a multi-billion-dollar shift in public sector cybersecurity spending.