I'd say he's probably right on the smaller companies. I think the average number of days that a threat exists on a network before it's discovered is 271 days. That's probably less true of larger organizations. Honestly, I couldn't tell you what that number is. There are a number of different surveys that scatter about on what that numbers is, but it's bigger than it should be.
On March 18th, 2019. See this statement in context.