How fast hackers attack is the question that quietly decides whether your business gets hit, and almost nobody asks it.
You know the notification. A window appears on a laptop saying an update is available. Somebody clicks “remind me later,” because there is a client on the phone and the update takes eleven minutes.
That decision used to be harmless. It is not anymore, and CrowdStrike published the numbers on August 3 that explain why.
What the researchers actually measured
Software makers fix flaws constantly. When they publish a fix, they also publish a description of the flaw, so their customers understand what they are protecting themselves against.
Shortly afterward, security researchers often release what the industry calls a proof of concept: a working demonstration that the flaw is real. It exists for legitimate reasons, mostly so defenders can test whether they are exposed.
Attackers read the same publications.
CrowdStrike found that 88% of the exploitation it observed, in cases where such a public demonstration existed, happened within 48 hours of its release. Chinese state-linked groups moved faster still, attacking within 24 hours of some critical disclosures.
One example gives the scale. After a flaw known as React2Shell became public, CrowdStrike’s hunting team surfaced more than 800 investigation leads across over 80 victim organizations. That took four days.
Read that as a business owner rather than an engineer. The window between “a problem became public” and “somebody is using it against companies like yours” is now measured in hours.
Why everything got faster
The report’s central finding concerns artificial intelligence, and it is not the version you read in headlines.
Attackers are not deploying mysterious autonomous weapons. They are using AI the same way your team does: to do repetitive work faster. Reading a technical disclosure, writing working attack code, finding which companies are exposed, and drafting convincing messages all used to take a skilled person several days.
Now much of it takes an afternoon.
That is the whole story. How fast hackers attack changed because the slow, skilled, manual part of their job got automated. The economics shifted, so smaller targets became worth the effort.
It is not only about software updates
Speed shows up everywhere in the report, including in the attacks that involve no software flaw at all.
Phone-based fraud, where somebody calls your staff pretending to be IT support, doubled in the first half of 2026 compared to the previous six months. A specific trick that pushes employees to approve a login on their own device jumped fifteenfold in six months.
Then there is the figure that should shape your response plan. CrowdStrike tracked one group that moved from taking over an account to stealing data in under five minutes.
What five minutes means for you
Most small businesses have an implicit plan. Somebody notices something odd, mentions it at lunch, and calls the IT provider that afternoon. The provider looks at it the next morning.
That plan assumes you have days. You have minutes.
This is not an argument for panic, because panic buys nothing. It is an argument for knowing, today, who picks up the phone at 8 p.m. on a Friday and what that person is authorized to do without waiting for you.
Why this hits companies without an IT team hardest
Here is the uncomfortable part, and it concerns your contract rather than your technology.
Plenty of small businesses are served on a monthly rhythm. Someone comes by, applies updates, checks the backups, and leaves. That model was reasonable when a newly published flaw took weeks to become a real threat.
Against a 48-hour window, a monthly visit means your business spends most of the month exposed to problems that were already public knowledge.
The fix is not more visits. It is updates that install automatically without waiting for a human, and somebody who watches for the handful that fail. That capability exists, it is not expensive, and many owners are already paying for a contract that quietly does not include it.
Questions to ask your IT provider
You will not evaluate any of this yourself. You will evaluate the answers, which is a different skill and one you already have.
Ask your IT provider: when a serious flaw becomes public on a Saturday, what happens in our company before Monday?
Ask your IT provider: do our computers and servers install security updates automatically, or does somebody apply them during a scheduled visit?
Ask your IT provider: how many of our machines are currently behind on updates, and can you show me that number today?
Ask your IT provider: if an employee’s account is taken over tonight, who notices, how quickly, and what do they do without calling me first?
Ask your IT provider: what is our written response time for a suspected compromise, and where is it written?
That last question does more work than the other four. A provider who can point to a document has thought about this. A provider who improvises an answer is telling you that your response time is whatever their schedule allows.
The habit that costs nothing
Give your team one instruction and repeat it until it is boring.
When a work device offers a security update, install it before the end of the day. Not next week. That single behavior closes most of the 48-hour window on the machines you control, and it costs eleven minutes.
Then handle the second half yourself. Read your IT contract and find the sentence about response time. If there is no such sentence, you have found this quarter’s most useful conversation.
What to take from this
How fast hackers attack is now the single number that separates a business that absorbs an incident from one that spends three weeks recovering from it. Everything else, the tools, the brands, the acronyms, matters less than the delay between a problem appearing and somebody acting on it.
You do not need to understand the attacks. You need to know your own reaction time, and today most owners cannot state it.
Alchanis Technical Services is a veteran-owned security firm that works alongside small and mid-size businesses without a security team of their own. If you cannot say how quickly your company would react to a problem that goes public tonight, start with that question. Visit alchanistech.com and we will measure it with you.
