Mandiant’s M-Trends 2026 figures sharpen an old warning: if exploitation can follow initial access in a median of 22 seconds, detection cannot stay a manual craft.