Ransomware is being deployed within one day of initial access in more than 50% of engagements.

In just 12 months the median dwell time identified in the annual Secureworks State of the Threat Report has freefallen from 4.5 days to less than one day.

In 10% of cases, ransomware was even deployed within five hours of initial access.

https://www.secureworks.com/about/press/ransomware-dwell-time-hits-low-of-24-hours