That’s part of the issue but it’s also a result of changing tactics. A whole ecosystem of hacker for hire companies have sprung up and among them are initial access brokers. They gain access to a network and often sit for months, slowly expanding access and collecting information to sell to other hackers for them to exploit. A few years ago the average time between an attacker gaining a foothold and exploitation was 5 hours. It’s grown to 9 months today.