NIS2
You Have 24 Hours. The Attacker Had 29 Minutes. Neither Number Matters.
NIS2 gives you 24 hours to report. The average intrusion is over in 29 minutes. Everyone points at that gap and calls the regulation obsolete. They are aiming at the wrong number, and the real one is far worse.