In IT security, speed is everything. If security professionals can’t stay one step ahead of cybercriminals, both systems and data are at risk.

But this is no easy task. As noted by Silicon Angle, threat actors are constantly improving their arsenals with new attack vectors while also enhancing high-value threats such as ransomware. It’s no surprise that companies rely on a mix of manual, automated and third-party security controls to keep malicious actors at bay, even as they work to predict what comes next.

The problem? There’s little chance fraudsters will have trouble hurrying past existing security measures. According to “The Black Report” by Nuix, most penetration testers need less than 12 hours to compromise corporate networks.

Breaking Security Controls in Time for Dinner

As noted by ZDNet, the survey of 70 professional hackers doesn’t paint a pretty picture. Eighty-eight percent of respondents said most network defenses could be breached in under 12 hours, and one-third reported that their activities had never been noticed by a potential target.

It gets worse from there: About 17 percent of survey participants claimed they could compromise security controls in just two hours. Forty-three percent said they had the most luck with direct server attacks and 40 percent preferred to phish for vulnerabilities. Also worth noting, 30 percent reported that they could “find and siphon out target data” in under six hours, while approximately 20 percent claimed they could manage the job in less than two, according to Dark Reading.

These are just penetration testers — professionals who are contracted by companies to gauge the readiness of network security systems. This means they’re governed by at least basic rules of engagement, which forbid actually destroying data or rendering networks useless. Black-hat hackers come with no such scruples.

Hitting Back With Agile Security and Threat Hunting

Existing security controls aren’t enough to defend corporate systems and keep data safe, so how can companies limit the chance of total compromise? Agile security is part of the answer. Cloud-based solutions and robust data analytics can help fend off less-committed attackers.

But stopping cybercriminals in their tracks requires a different outlook. As noted by TechTarget, there’s a new role emerging in enterprise security: the threat hunter. Think of it like a penetration tester with the sole purpose of finding security holes overlooked by automated tools.

According to Johna Till Johnson of Nemertes Research, these threat hunters are “part of a mature security operation” and can help shift companies from reactive or proactive to “anticipatory,” postures, TechTarget noted. That allows them to focus on new and emerging threats rather than playing catch-up with existing attack vectors.

The bottom line is that current security controls won’t keep out determined fraudsters. In under half a day, most can crack corporate systems and exfiltrate target data. While purpose-built, agile security tools can help extend the time needed to break down corporate walls, substantial posture shifts depend on a combination of automated detection and human-hunted threats.