This research focusses on the performance and timing behavior of a two level survivability architecture. The lower level of the architecture involves attack analysis based on kernel attack signatures and survivability handlers. Higher level survivability mechanisms are implemented using migratory autonomous agents. The potential for fast response to, and recovery from, malicious attacks is the main motivation to implement attack detection and survivability mechanisms at the kernel level. A timing analysis is presented that suggests the real-time feasibility of the two level approach. The limits to real-time response are identified from the host and network point of view. The experimental data derived is important for risk management and analysis in the presence of malicious network and computer attacks.