Breakout time is the period between an attacker’s first successful compromise and the moment they begin lateral movement inside a network. In practice, it measures how quickly a foothold turns into a broader internal incident. A short breakout time means the defender has very little room to detect the intrusion before the attacker starts reaching other hosts, accounts, or cloud resources.
This term matters because lateral movement is often the point where a contained problem becomes a serious breach. Attackers try to shorten breakout time by automating reconnaissance, credential use, and internal exploration; defenders try to lengthen it through rapid alerting, centralized telemetry, segmentation, least privilege, and zero-trust controls. Strong visibility across identity, endpoint, and network data can reveal the early signals that separate an isolated compromise from active spread.