Mandiant warns public-sector attacks compress to 22 seconds

Google Cloud’s public-sector writeup is half warning and half sales funnel, which is normal for a vendor threat report and still leaves useful material for agencies. The central claim is blunt: Mandiant saw a median 22 seconds between an initial access broker establishing a foothold and handing access to a ransomware operator. If that number holds in the underlying report, ordinary ticket-driven triage is too slow for the first phase of the incident. That does not mean every agency needs Google’s stack. It does mean detection, containment and escalation assumptions built around human review deserve a hard look.

The more durable findings are less cinematic. Mandiant says some state-sponsored actors remained undetected for more than five years, which makes 90-day telemetry retention look like a governance choice with incident-response consequences. It also says attackers are targeting virtualization management planes, including snapshot mounting to steal domain-controller databases outside guest-level security controls. For state and local agencies, the SaaS point is the familiar bad bargain: integrations built for convenience turn service accounts and OAuth tokens into blast-radius multipliers.

The practitioner takeaway is concrete. Inventory non-human identities, shorten help-desk exception paths, review virtualization-admin monitoring, and decide whether retention windows can actually support breach scoping. Google’s answer is context-aware access, Google Security Operations and Google Threat Intelligence. Fine. But the report’s compliance value is independent of the brand: agencies cannot prove resilience with a checklist that never sees the management plane, the token, or the phone call that started the incident.