Yes. Also, both.

An attack is just a special case of building a computer system. Planning, building, and testing often take a while. Execution can happen very quickly indeed. If you time the attack from "start of execution of final payload script" through "last byte of data transferred by payload script" then many commercially significant attacks were over in milliseconds.