Assertion Partly supported AI assessment confidence: 85% certainty 4/5 debate potential 2/5

Falkowitz: Companies take a year to discover cyberattacks after phishing starts

Oren Falkowitz · Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital) · Oct 21, 2015 · at 6:37

Oren Falkowitz, founder and CEO of Area 1 Security, explains the lag time between breach initiation and corporate detection.

0:00 / 0:04exact quote · 4.9s

▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark

“These companies are only learning about these attacks a year after this initial phishing starts, right?”

quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →

The claim, plainly

Companies typically learn about cyberattacks one year after the initial phishing attack begins.

a quote alone can be ambiguous, so this restates it with the references and context of the conversation around it resolved. AI-written; the tape below the player is the source.

Assessment

In October 2015, then-CEO of Area 1 Security Oren Falkowitz stated on a podcast that companies typically learn about cyberattacks a year after initial phishing begins. Major 2015-2016 cybersecurity benchmark reports indicate that while 'one year' (365 days) was a reasonable approximation for certain subsets of breaches, it overstated the overall median detection time (dwell time). Ponemon Institute's 2015 Global Cost of Data Breach Study reported a mean time to identify malicious cyberattacks of 256 days (approx. 8.5 months). Mandiant's M-Trends reports indicated a global median dwell time of 205 days (approx. 6.8 months) in its 2015 report (2014 data) and 146 days (approx. 4.8 months) in its 2016 report (2015 data). However, Mandiant's 2016 report noted that breaches detected via external third parties took a median of 319.5 days (approx. 10.5 months, within 13 percent of one year). Because Falkowitz's offhand estimate captures the general magnitude and closely matches external detection timelines but overstates overall average dwell times, the claim is partially true.

Mandiant M-Trends 2015 Report: Global median dwell time was 205 days (~6.8 months).
Mandiant M-Trends 2016 Report: Global median dwell time was 146 days (~4.8 months), though external third-party detections took a median of 319.5 days (~10.5 months).
Ponemon / IBM 2015 Global Cost of Data Breach Study: Mean time to identify malicious attacks was 256 days (~8.5 months).

Checked against

[1] google.com [2] darkreading.com [3] scworld.com [4] ponemon.org [5] securityaffairs.com [6] cloudmask.com [7] tripwire.com [8] prnewswire.com

"Oren Falkowitz" "one year" OR "dwell time" OR "phishing" Verizon DBIR 2015 time to detection dwell time Mandiant M Trends report 2015 breach detection time Ponemon Institute 2015 cost of data breach time to detect days

assessed as of 2026-07-31

This assessment is an AI reading of a public statement, made against the cited references with the confidence shown. It can be wrong. The quote, the tape and the references are all on this page; if something is off, use report an error below. full disclaimer →

Mentioned

companies cyberattacks

⚑ Spot an error? Report it

More from Oren Falkowitz

Opinion

Falkowitz: Training employees to spot phishing attacks does not work

“So I'm gonna train all of you to spot phishing. That's not gonna work, right”

Oren Falkowitz Oct 21, 2015 ▶ 17:00 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Assertion Not checkable as stated

Falkowitz: Area 1 Security has captured the entire internet for security

“What we've been able to do is capture the entire Internet, right, in a way that maybe you would think Google or others do, right, and to do that for a very specific sort of security purpose.”

Oren Falkowitz Oct 21, 2015 ▶ 11:43 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Assertion Not checkable as stated

Area 1 Data: Top spam filters miss 9 targeted phishing emails per million

“Our data shows that for every one million messages a company receives, nine of them are of a targeted and sophisticated nature that the best spam, Google spam, others are going to miss, right?”

Oren Falkowitz Oct 21, 2015 ▶ 17:23 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Assertion Partly supported

Falkowitz: 97% of all cyberattacks begin with phishing

“97% of all attacks Begin with phishing.”

Oren Falkowitz Oct 21, 2015 ▶ 5:15 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Assertion Partly supported

Ten phishing emails yield a 90 percent success probability within 90 seconds

“If you send just 10 messages to a company, there's a 90% success rate that one of those users is going to click, and it takes less than 92nd, is this videotape, by the way? It takes, and it takes less than 90 seconds, right, for that to happen.”

Oren Falkowitz Oct 21, 2015 ▶ 5:48 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Insight

Falkowitz: Cyberattacks operate as long campaigns, not instantaneous events

“A lot of my colleagues and senior executives from the government will often talk about cyber attacks as being at speed of light or network speed, right, is, is the example. But I think the reality is when you look at the data and from what we observe that, tha…”

Oren Falkowitz Oct 21, 2015 ▶ 8:15 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Falkowitz: Companies take a year to discover cyberattacks after phishing starts

More from Oren Falkowitz

Turn any episode into a week of clips.