90 minutes is the number we keep coming back to. Not because it’s an average — every engagement is different — but because it’s a realistic, repeatable time-to-impact for one specific and common failure pattern: an internet-facing VPN or remote-access appliance with a known, patchable flaw, sitting in front of a flat internal network. Here is what that walk actually looks like, stage by stage, and the three points along the way where a defender could have stopped it cold.
T+00 · Initial access. The entry point is rarely exotic. Internet-facing VPN concentrators, remote-access gateways and edge firewalls have had a steady drumbeat of unauthenticated or pre-auth remote-code-execution disclosures over the past few years, and patch cycles on these appliances lag badly — they’re treated as infrastructure, not attack surface, until it’s too late. A public exploit against an unpatched instance gets an attacker a foothold and, often, a set of cached or harvestable credentials in the same step.
T+15 · Credential access. From that foothold, the attacker isn’t hunting for a second exploit — they’re hunting for anything that looks like a password, a session token, or a service account. Config files, memory, browser-stored credentials and cached VPN sessions all get harvested within minutes. On a pure perimeter breach like this one, valid low-privilege credentials are usually sitting right there waiting to be found.
T+30 · Lateral movement. With one working set of credentials, the attacker stops looking like malware and starts looking like an employee. Legitimate remote-management tools already present on the network — RMM agents, PsExec, WMI, RDP — get used to move host to host. This is the stage most signature-based tooling misses entirely, because nothing about it is inherently malicious. It’s living off tools that were already trusted.
T+60 · Privilege escalation. Somewhere in the first hour, the attacker finds the thing that turns a foothold into domain control: a misconfigured Group Policy Object, an over-permissioned service account, a Kerberoastable ticket, an unconstrained delegation setting nobody remembers enabling. Flat internal networks and years of accumulated Active Directory debt make this step depressingly reliable. Once domain admin is reachable, the timeline compresses fast.
T+90 · Encryption-ready. Domain-level access means the attacker can stage, disable backups and EDR where reachable, and pre-position for detonation across the estate — often before a human on the defending side has noticed anything beyond a handful of low-severity alerts. Whether the operator encrypts immediately or sits quiet and exfiltrates first is a business decision on their end, not a technical constraint. Either way, the organisation has already lost control of the outcome.
Three points where this specific walk could have ended early:
- Patch cadence on edge infrastructure — the initial exploit only works because the appliance was unpatched. Perimeter and remote-access infrastructure needs the same patch SLA as anything customer-facing, not the “we’ll get to it next quarter” treatment it usually receives.
- Lateral-movement visibility — living-off-the-land tooling is hard to catch by signature, but very catchable by behaviour: a workstation account authenticating to a dozen hosts it has never touched before is a strong signal, if anyone — or anything — is watching for it.
- Tiered administration — domain admin should not be reachable from a compromised standard workstation in one or two hops. Tiered access and clean separation between admin and user credentials turn a 90-minute path into a much longer, much noisier one.
None of these three controls are exotic, and none require a bigger security budget than most mid-sized organisations already have — they require someone to have actually walked the path before an adversary does, and to keep walking it as the environment changes. That’s the whole argument for testing continuously rather than annually: a once-a-year assessment tells you whether this path existed on the day of the test. It says nothing about the Tuesday three months later when someone stood up a new VPN gateway and forgot to patch it.