Consider an ordinary Tuesday morning at a Malaysian enterprise.

The security operations team sits down with overnight logs. The dashboard looks manageable. Then, buried in the data, they find an alert that triggered the previous evening. When they trace it back, they discover the attacker gained access to the network four hours before that alert fired. In the 29 minutes that followed initial access, the intruder moved laterally across three systems, escalated privileges on one, and established a persistent foothold.

By the time anyone read the alert, the campaign was complete. What the dashboard recorded was not a threat in progress. It was a record of what had already happened.

This is not a constructed hypothetical. It describes the operational reality now documented in the security industry’s most closely watched research.

CrowdStrike’s 2026 Global Threat Report found that the average time between an attacker’s initial access and their first lateral movement across a network dropped to 29 minutes in 2025. That is a 65 per cent acceleration from 2024, when it stood at 48 minutes — itself down sharply from 98 minutes in 2021. The fastest breakout observed in 2025: 27 seconds. In one documented intrusion, data exfiltration began four minutes after initial access.

These numbers have a concrete implication. The traditional security model — detect, investigate, respond — assumes a meaningful window between the moment a threat enters and the moment it causes damage. That window has not merely narrowed. At the leading edge of modern intrusion, it no longer reliably exists.

Set that against a different number from the IBM Cost of a Data Breach Report 2025: organisations still take an average of 241 days to identify and contain a breach. The attacker is completing campaigns in the time it takes most organisations to read their morning messages. Detection arrives months later.

The gap between those two timelines is not a tool problem. It is a detection-architecture problem.

The acceleration is not the result of attackers becoming individually more skilled. It is the result of them no longer needing to be.

Artificial intelligence has automated the steps in an intrusion that previously required human time. Reconnaissance that demanded skilled operators working over days now runs as scripted routines. Credential testing, vulnerability scanning, and lateral movement planning that took experienced teams hours now execute in minutes without direct human involvement. The attacker can initiate a campaign and step away. The automation runs the operation.

CrowdStrike’s 2026 report documented an 89 per cent year-on-year increase in AI-enabled adversary activity. The technology has not fundamentally changed what attackers want — access, data, leverage. It has compressed the time between intent and execution to a point where human-speed response becomes, in many scenarios, irrelevant.

The distinction matters for how enterprise leaders should think about this problem. This is not an argument for purchasing AI-powered security tools. It is an argument for recognising that the assumption underlying current detection timelines — that defenders have time — is being systematically invalidated.

For organisations operating in Malaysia, this is not an abstract global trend.

Pikom’s Beyond Compliance: The State of Cyber Resilience in Malaysia 2026 report found that 35.9 per cent of surveyed organisations experienced at least one cybersecurity incident between January 2024 and December 2025. The average cost of a data breach in Malaysia is projected at RM3.2 million this year, with some organisations reporting losses exceeding RM5 million from a single incident.

The most common attack vectors offer their own signal. AI-generated phishing or deepfake impersonation accounted for 32.6 per cent of attacks, followed by malware or ransomware-as-a-service at 30.2 per cent, and credential theft at 25.6 per cent. These are not brute-force campaigns. They are identity-targeted, AI-assisted operations designed to gain access through human vulnerabilities before conventional defences detect them.

Data from MyCERT adds further context. In the first quarter of 2025, intrusion incidents in Malaysia rose 76 per cent compared to the previous quarter. The average time to detect a breach locally stands at approximately 187 days.

Attackers targeting Malaysian organisations are completing their campaigns in under 30 minutes. Malaysian organisations are, on average, discovering those campaigns six months later.

Malaysia’s Cyber Security Act 2024 introduced mandatory notification requirements for organisations operating within the country’s National Critical Information Infrastructure. When an incident is discovered, entities must notify NACSA within six hours. Further details are required within 14 days. Under the PDPA amendments, breach notification to affected parties carries a 72-hour window, with non-compliance carrying fines of up to RM1 million.

The intent is sound. Faster disclosure enables faster national coordination. The policy assumes, however, that organisations can discover incidents before the notification window becomes meaningless. When the average detection lag runs to nearly six months, the six-hour clock starts far too late to protect anyone.

This is not a flaw in the regulatory framework. It reflects a detection architecture problem that regulation alone cannot address. Compliance and security are not the same discipline. An organisation can technically comply with every notification requirement while still discovering breaches months after attackers have completed their work and exited.

The answer to this gap cannot live in policy. It has to live in when and where detection begins.

Most security tools are positioned inside the organisation’s environment. They receive traffic after it has arrived, generate alerts after events have been recorded, and respond after something has occurred. By the time detection begins, the attacker has already crossed the threshold.

Time Secure Network operates from a different position entirely.

Because Time builds and operates its own national network infrastructure, every connection made by an organisation on Time’s enterprise network passes through Time’s border router before reaching any firewall, any endpoint, or any downstream security system. This is the first physical point through which all traffic — inbound and outbound — must travel.

Using each organisation’s fixed IP address, the unique network identifier tied to their Time connectivity, Time Secure Network monitors this traffic at the border router in real time. It does not rely on known threat signatures. It does not wait for a log to be written inside the environment. It looks for patterns that signal intent: high-frequency probing of specific services, outbound connections to known malicious destinations, authentication behaviour that suggests credential abuse in progress. These are not events that have happened. They are the early shape of what an attack is becoming.

This is the difference between event-based and intent-based detection. Traditional tools respond to what has already occurred. Time Secure Network observes what is approaching.

Two real situations illustrate what this means in practice.

An attacker scanned a customer’s VPN endpoint 400 times within 24 hours — a reconnaissance pattern consistent with DDoS preparation. Nothing inside the customer’s environment triggered. No firewall rule was activated. No endpoint alert fired. At Time’s border router, the frequency and pattern of that scanning was already visible, correlated in real time against threat intelligence identifying the source as a known threat actor. The customer blocked the offending IPs immediately. The attack stopped before it reached the firewall. No exploitation attempt ever entered the environment.

In a second case, an infected device inside a customer’s network began communicating outward to a command-and-control server — dormant malware activating and seeking instructions. That outbound connection appeared at the network layer before any SIEM correlation inside the environment had identified the activity. The infected host was isolated within the hour. Lateral movement was contained before the malware could act on the commands it was attempting to receive.

In both cases, detection did not happen because something had occurred inside the environment. It happened because the network — the infrastructure that carries all traffic — had already seen what was forming at the edge.

The standard argument for faster detection focuses on breach costs. IBM’s data confirms it: organisations that detect and contain threats faster see approximately 22 per cent lower total breach costs. That is meaningful in financial terms.

But the more consequential benefit is operational, and it is harder to put a number on.

A security team that detects an intrusion during reconnaissance, before exploitation has begun, is making choices. It is deciding how to respond, which assets to protect, when to isolate, whether to engage law enforcement. A team that discovers a breach 187 days later is doing something fundamentally different. It is assessing damage. It is managing consequences that are already fixed.

The difference between those two states is time. Not tools, not frameworks, not headcount. Time.

Earlier detection at the network layer changes this equation. Time Secure Network, delivered directly through Time’s wholly owned infrastructure, identifies early-stage attacker behaviour — reconnaissance, scanning, probing — at the WAN layer before exploitation reaches internal environments. Those signals feed directly into Time’s Cyber Security Operations Centre, where a dedicated team operates around the clock to correlate, validate, and act on them.

The result is not just faster response. It is response that happens within the attack window rather than long after it has closed. Time Secure Network is documented to detect attacker intent one to three days before exploitation begins — shifting security operations from damage control to proactive containment.

Most organisations frame their security in terms of tools. Do we have a next-generation firewall? Yes. Endpoint detection and response? Yes. A SIEM platform and a managed SOC? Yes.

These are the right investments. But they answer a question that is no longer the most important one.

The more precise question — the one that the data in 2026 demands — is: how much time does our security architecture earn us between when an attacker enters and when we know?

For a CISO or board director, that reframe has direct consequences. An organisation can maintain sophisticated endpoint protection, a mature SIEM platform, and a well-resourced response team, and still face a scenario where an attacker completes lateral movement, establishes persistence, and begins data staging before any of those tools have generated their first meaningful alert. The tools are not the problem. The moment at which they activate is.

Nagendran Balakrishnan, Head of Time Enterprise Product, put the distinction clearly in an earlier conversation: “When you can identify patterns like reconnaissance at the network level, you are no longer waiting for an incident to happen. You are acting on intent, not reacting to impact.”

That difference — intent versus impact — is the distance between those two operational states described above. Organisations that close it will operate with a different quality of security posture. Not because they have more tools. Because their detection begins at the one layer no attacker can avoid.

The first article in this series made the case that threats begin with intent, not alerts. The network is where that intent first becomes visible, before it reaches applications, endpoints, or users.

This article adds the dimension that makes that argument urgent rather than theoretical: intent now moves in minutes, and the organisations that detect it only at the point of exploit or execution are already operating behind the clock. They are not responding to a threat. They are recovering from one.

Together, the argument reduces to something straightforward. Detecting earlier requires detecting in the right place at the right moment. The network is both. Moving detection to the WAN layer does not replace the security stack that follows. It earns the stack the time it needs to matter.

In an environment where the fastest recorded breach played out in 27 seconds, that is not an incremental upgrade. It is the architectural decision that makes the rest of the security investment count.

Time Secure Network is Malaysia’s first network-native threat intelligence capability, delivered at the WAN layer through Time’s wholly owned infrastructure, with no agents, no network redesign, and no operational complexity. To learn more or schedule a consultation, visit the Time Secure Network page.