The first 60 minutes of a cyberattack — what really happens and why every minute matters

A cyberattack does not begin when servers are encrypted. Email works, ERP responds, staff log in and customers report no problems. Yet in many incidents, an attacker already has initial access and is examining privileges and important systems in the background.

The first 60 minutes of a cyberattack is a response window. Security monitoring, SOC 24/7, SIEM, EDR/XDR and Incident Response create opportunities to contain an incident before it becomes an operational crisis.

What should you know?

• A cyberattack does not start with data encryption. Encryption can be the culmination of earlier reconnaissance, privilege escalation and lateral movement.
• No visible business symptoms does not mean no incident. Systems often operate normally during the first minutes.
• An alert is not a response. Analysis, correlation, classification and decisions create a real defensive capability.
• SOC 24/7 narrows the gap between signal and action, particularly outside working hours.
• MTTD and MTTR reflect operational resilience. Shorter detection and response times improve the chance of limiting losses.

An opening scenario

Encrypted files, unavailable ERP, stopped production or inaccessible email are often only the moment when the organisation sees the consequences. A typical scenario begins earlier with phishing, stolen credentials, VPN access or an internet-facing vulnerability.

In the first minutes, there may be no ransom note, application failure or user report. Instead, a single alert may appear: an unusual login, suspicious endpoint behaviour or an attempt to access an unfamiliar resource.

Without round-the-clock analysis, the signal may remain in a queue. For the SOC, it requires correlation and escalation. This separates reacting to consequences from detection before those consequences stop the business.

The business problem

For management, the CTO, CIO and IT Manager, the first 60 minutes are when the organisation retains control or starts losing it.

Early detection can often limit impact to an account, workstation or network segment. Undetected activity gives the attacker time for reconnaissance, privilege escalation and lateral movement.

A security incident then becomes a business problem: downtime, data loss, disrupted customer service, regulatory pressure, management accountability and reputational damage.

What Incident Response is

Incident Response is a structured security incident response process: preparation, detection, analysis, classification, escalation, containment, root-cause remediation, recovery and lessons learned.

It is not a single tool — EDR, SIEM, a firewall or backup — nor an after-hours call to an administrator. Incident Response connects people, procedures and technology. Before an incident, establish who analyses, escalates, isolates accounts or hosts and involves the CTO, CIO or management.

This understanding reflects VigilHorizon’s approach: start with real operational capability, not technology deployment alone. Technology detects signals; roles, escalation paths, decision criteria and out-of-hours accountability determine response quality.

Time is the most important resource in the first hour, but only when the organisation knows who decides, which actions are authorised and how to activate Incident Response. Otherwise, even a good alert is merely information nobody acted on promptly.

Why response time determines incident scale

After obtaining access, an attacker generally works purposefully: identifying privileges, important assets, critical systems and ways to increase impact.

Having EDR, SIEM or firewalls does not establish that a company will detect and stop an incident. Someone must assess alert context, connect events, assign priority and decide whether to activate Incident Response.

This is why the following matter: MTTD and MTTR. MTTD shows how quickly an organisation detects an incident. MTTR shows how quickly it contains the impact or regains control. 'We will respond in the morning’ assumes the attack will wait too.

An attack timeline: the first 60 minutes

Cyberattacks differ, but many follow a similar logic: initial access, reconnaissance, privilege escalation, lateral movement and preparation for impact.

Minute 0 — initial access

A typical scenario involves phishing, stolen credentials, VPN access or an internet-facing vulnerability. There is no outage yet, but monitoring should record an unusual login, new device or EDR/XDR alert.

Minutes 5–15 — environmental reconnaissance

The attacker examines users, resources, servers, directories, privileges and dependencies. The business still sees nothing wrong. For the SOC, individual alerts begin to form an incident pattern.

Minutes 15–30 — privilege escalation

After reconnaissance, the attacker looks for privileged accounts, administrative resources, file servers or critical applications. Greater influence over the environment makes containment harder.

Minutes 30–45 — lateral movement

Lateral movement means moving between systems, accounts and assets. This is no longer one workstation’s problem. The SOC should correlate logs, EDR/XDR, identity and network signals.

Minutes 45–60 — preparing for impact

In this illustrative first-hour timeline, the final quarter-hour involves preparation for encryption, data theft or system disruption. Backups, recovery systems, central servers and privileged accounts become particularly important.

Time	What the attacker does	What the SOC should do	The organisation’s decision	Risk
0 min	Initial access	Check the account and device	Analyse the alert?	A lost response opportunity
5–15 min	Discovery	Correlate logs and identity	Is this an incident?	Identifying targets
15–30 min	Privilege escalation	Raise the priority	Activate IR?	Wider scope
30–45 min	Lateral movement	Recommend isolation	Quarantine?	Attack spread
45–60 min	Preparing for impact	Protect backups	Activate the full playbook?	Operational crisis

How the attack could have been stopped

A single tool cannot always stop an attack. Its progress can be contained when technological signals are quickly turned into decisions.

EDR/XDR reveals suspicious endpoint behaviour: an unusual process, credential use or activity outside the user’s profile. SIEM links it with logins, network and identity data. The SOC checks whether it is isolated or the start of a sequence leading to lateral movement.

In practice, containment can involve blocking accounts, isolating hosts, restricting access, protecting backups and activating the appropriate playbook. Tools provide visibility; the SOC and Incident Response turn it into action.

At VigilHorizon, SOC 24/7 does not end with forwarding an alert. It takes ownership of analysis, classification, recommended actions and agreed escalation. The customer receives structured operational context, not just a notification.

EDR observes endpoints, XDR combines context across more layers, and MDR is a managed detection and response service. Explore this further in: EDR, XDR and MDR — how do they differ, and when are they enough without a SOC?.

Professional Incident Response, step by step

A professional response needs a clear sequence: anomaly detection, event correlation, classification, escalation, an isolation decision, playbook activation, evidence preservation, business communication and lessons learned.

Stage	Objective	What SOC / IR does	Business significance
Detection	Notice an anomaly	Analyse a signal from SIEM, EDR/XDR or identity systems	Less time spent in uncertainty
Correlation	Connect events	Compare account, host and network activity	Recognise the incident sooner
Classification	Assess priority	Establish scope and the need for escalation	Better decisions under pressure
Escalation	Engage the right people	Contact IT, the CTO/CIO or management	Less confusion in decision-making
Limitation	Stop the incident developing	Isolate an asset, block an account or restrict access	Lower spread risk
Recovery and lessons learned	Restore operations and improve resilience	Validate the environment and update playbooks	Shorter downtime and lower recurrence risk

Scenario: a company without a SOC and a company with SOC 24/7

Without prepared IR, the first hour is often time lost rather than time spent responding. An alert appears overnight or at a weekend. EDR/XDR records suspicious behaviour, SIEM collects logs and identity systems record an unusual login. Nobody analyses the signals in real time.

An organisation with prepared IR does not assume it will avoid every attack. It aims to detect quickly, limit impact and recover. The first alert starts a process, and decision-makers receive clear choices: isolate an account, protect backups or escalate to management?

Area	Without 24/7 monitoring	With a 24/7 SOC	Business consequence
First alert	Enters a queue or waits until morning	Is analysed in real time	Less uncertainty
Event correlation	Logs and alerts remain scattered	The SOC connects SIEM, EDR/XDR and identity data	Faster distinction between incident and noise
Escalation	It is unclear who decides outside working hours	An escalation path is in place	Less confusion in decision-making
Isolation	Decisions are delayed or improvised	Decisions to restrict an account, host or segment are made sooner	Lower spread risk
Backups	Compromise risk is detected too late	Backup access is treated as critical	A greater chance of recovery
Management	Sees consequences once the business is affected	Receives information about impact and decisions	Better control over communication

Common organisational mistakes

• Waiting until morning. An alert without 24/7 analysis provides no operational advantage.
• Relying on the tool alone. EDR, SIEM and firewalls do not replace decisions or escalation.
• Missing playbooks. A procedure developed during an attack usually arrives too late.
• Unclear isolation authority. If nobody knows who can disconnect an account or host, the incident gains time.
• Neglected backups. Backups must be protected, monitored and tested, not merely available.

How to prepare your organisation

Preparing for the first 60 minutes combines technology, accountability and rehearsed procedures. An organisation should have 24/7 monitoring, a functioning SOC, suitable data sources and Incident Response procedures.

SIEM, EDR/XDR, identity systems, server logs, network monitoring and critical applications should provide the data needed to understand incident context. Playbooks should cover ransomware, compromised accounts, lateral movement, data breaches, threats to backups and out-of-hours incidents.

This also requires exercises, MTTD and MTTR analysis, backup recovery tests and links between cybersecurity, Business Continuity and Disaster Recovery. A procedure nobody has rehearsed often fails when it is needed most.

VigilHorizon therefore assesses readiness through process: visible data sources, decision-making authority, escalation, backup protection and the connection between Incident Response, Business Continuity and Disaster Recovery. This clarifies ownership before time pressure arrives.

Readiness checklist

Check question	Select an answer
Does security monitoring operate 24/7?	YES / NO
Are alerts analysed outside working hours?	YES / NO
Does the organisation have an Incident Response process?	YES / NO
Is it clear who authorises account, host or system isolation?	YES / NO
Are there ransomware and compromised-account playbooks?	YES / NO
Does the SOC receive SIEM, EDR/XDR and identity data?	YES / NO
Are MTTD and MTTR measured?	YES / NO
Are backups monitored and tested?	YES / NO
Have IR procedures been exercised with IT, security and decision-makers?	YES / NO
Is IR connected to BCP and DR?	YES / NO

If most answers are 'NO’, missing tools are not the only problem. The organisation lacks operational readiness for an incident’s first hour.

Summary

The first hour often determines whether an incident ends with a compromised account and brief isolation or days of organisation-wide downtime.

This is about the ability to detect quickly, understand the situation, decide and limit impact, not a promise of complete security.

VigilHorizon supports readiness assessment, deployment of SOC 24/7, IR procedure verification and MTTD/MTTR assessment.

Assess your organisation’s readiness for the first 60 minutes of a cyberattack

The first 60 minutes should not be spent waiting for morning, an available administrator or manual alert checks. The organisation should be detecting, analysing, escalating and containing the incident.

VigilHorizon supports organisations with readiness assessment, deployment of SOC 24/7 and verification of Incident Response procedures.

Book a consultation to assess your organisation’s actual detection and response capability.

Contact us

Frequently asked questions (FAQ)

Does ransomware encrypt immediately?​

Not always. Encryption can be a late stage preceded by access, reconnaissance, privilege escalation and lateral movement.

Can a cyberattack be stopped in its first hour?​

In many scenarios, its scope can be limited before serious consequences develop. This is not a guarantee, but an important operational difference.

What should the SOC do after the first alert?​

Check the account, device, location, event time, related logs and previous activity.

Is SIEM enough to stop an attack?​

No. SIEM collects and correlates data, but does not replace analysis, escalation or decisions.

Is EDR/XDR sufficient without a SOC?​

Not always. EDR/XDR detects suspicious behaviour, but an alert without response remains information.

What are MTTD and MTTR?​

MTTD measures detection time. MTTR measures response, containment or restoration time, depending on the definition used.

What role do backups play in the first hour?​

Backups need protection from the outset. If an attacker reaches recovery systems, having a copy alone is insufficient.

Does NIS2 require a 24/7 SOC?​

NIS2 requires capabilities for detecting, analysing, responding to and reporting incidents. SOC 24/7 is one way to provide them.

What should management know during an incident?​

The business impact, customer risk, recovery priorities, communication needs and decisions requiring approval.

Why is the first hour so important?​

Because the incident can often still be limited to a single account, host or segment.

Related articles and services

• How does an Incident Response team stop a cyberattack, step by step?
• MTTD and MTTR — why detection time determines incident impact
• What is SOC 24/7? How a Security Operations Center works and why monitoring is not enough
• SIEM in a company—why deployment alone does not improve security
• EDR, XDR and MDR — how they differ and when they protect your business
• SOC 24/7