Swordfish's 60-second hack, and how long real break-ins take

In Swordfish (2001), Hugh Jackman's Stanley Jobson is given sixty seconds to break into a Department of Defense network while a gun is held to his head. He types fast, the screen flashes "access denied", and then he is in.

Real intruders are patient

Mandiant, which investigates breaches for a living, measures "dwell time": how long an attacker sits inside a network before anyone notices. Its M-Trends 2026 report put the global median at 14 days for 2025, up from 11 days the year before. For espionage cases the median was 122 days.

Genius is rarely required

Mandiant found that exploiting a known software flaw was the most common way in (32% of cases), with voice phishing, a convincing phone call, second at 11%. Email phishing was down to 6%. Verizon's 2025 Data Breach Investigations Report found a human element, such as a mistake, a misused password or someone being tricked, in about 60% of breaches.

How to spot a phishing email or call

• Urgency: "act now", "your account will be closed".
• A request for a password, a code or a payment you did not expect.
• A sender address or caller ID that is close to, but not exactly, the real one.
• Links whose real address does not match the text. Hover before you click.
• If in doubt, hang up or close the email and contact the company through its own website or app.