You have to look at the history of compression, and how this was done by conventional electronic means before you get any sort of idea of how it really works - and then you have to bear in mind that although software compression can get around some of the apparent problems raised, it isn't necessarily a good thing to do so.
The original problems with compression were twofold when it came to conventional electronic compressors. Firstly, they took time to analyse the incoming waveform; secondly, they took even more time to respond to changes. This was generally because the element doing the controlling of the signal (and there were several different methods) also had a finite response time. Generally the response of the controlling element was physically constrained, and this ultimately limited the attack time - even if you could detect a change quicker, you couldn't apply it any faster - you couldn't delay the output, which had to be acted on in real time. The response of the detector is essentially amplitude-based - if the first half-cycle exceeds the threshold amplitude, then in theory a corresponding signal is sent to the controlling element. The detector, though, always tracks the amplitude envelope of the incoming signal, and this is what determines, via the controls, the amount of compression. The decay time was determined entirely by controls though - the moment the signal envelope drops below the set threshold, the decay rate sets in. If the signal goes back up, then decay stops - after another attack time has passed.
The threshold control determines the point at which the controlling starts, and the ratio control determines the rate of change applied at that point. There's a threshold level at which gain reduction kicks in, and then the rate of gain reduction is set by the ratio control. If it's set at 2:1, then every increase in gain that there would have been is halved. If you set the ratio ridiculously high - let's say at 99:1, then you've built a limiter - for every increase in gain, there's effectively no increase in output. Except that this behaviour is modified slightly because of attack times and transients within them. If a transient occurs that's quicker than the total attack time of the system (detector and gain reduction element), then it will get through. The only way to stop this happening is to use a software compressor with look-ahead, as I mentioned earlier - that will catch everything.
Anyway, this is what software compressors were basically trying to emulate.
But what the software ones can also do is compensate for some aspects of compressor behaviour, because essentially they don't have to work in real time. This means that it's possible to use 'look-ahead'. If you do this, then theoretically you can make a good job of even catching the first half-cycle of a waveform that exceeds your threshold - because you've already done the detecting. And because you've got software control of the final amplitude rather than a hardware device, you can cause instantaneous changes to take place. But as anybody experimenting with a software compressor soon realises, most of the things that are possible don't happen - the devices are designed more along the lines of the original hardware, because that's what people actually want! They don't want instantaneous attack, because that gets rid of transients, and that's where a lot of the crucial information in a signal is. Also, for some tracks timed pumping is called for - and this requires a system with a known temporal response, not one where the rate of change of the input signal is determined and used in any way.
The other thing that you have to bear in mind is that we are creating a signal envelope. And in order to do this, we have to do some sums. What we are doing is technically known as integration - we are calculating the area under a curve, and to do this we need to have an integration period. With Audition and Cool Edit's Dynamics Controller we get options here to control this. And it's in the Attack/Release section of this that you get all the clues. Firstly, note that it tells you that it's the amplitude that is determined, not the rate of change, and secondly you can determine (because it has more options available than most compressors) how the amplitude envelope is determined in the detector - either by peak values, which means that the integration time is effectively the same as the sample rate, or by RMS values. It doesn't say what the RMS integration time is, but I daresay that it wouldn't be too difficult to determine this.
But Audition's Dynamics Controller is a good example of how software can emulate - and also overcome the limitations of - a hardware compressor. The detector and controller characteristics can be separately determined, and look-ahead can also be specified. I'm not 100% convinced that the output always reflects exactly what you set, but it gets pretty close. But just because you can overcome the way a hardware compressor works, it doesn't usually pay to do so unless you have a really good reason for doing so.