Sophos X-Ops found that median attacker dwell time—the time from when an attack starts to when it’s detected—shrunk from 10 to eight days for all attacks.