Breakout time is the clearest signal of how intrusion has changed, researchers say, as they see data exfiltration within minutes of initial compromise.