Skip to content
kevinferron.com

T1 · Security in the age of AI · Interactive, in your browser

The hours nobody is watching

Set the hours a team is at work, see how much of the week that leaves unwatched, and set it against when ransomware is launched and how fast intruders move.

A team that works business hours is present for under a third of the week, and the clocks that matter run in seconds, minutes and days.

The week, hour by hour

MonTueWedThuFriSatSun00:0003:0006:0009:0012:0015:0018:0021:00
  • Watched, in the band
  • Watched, outside it
  • Nobody watching
  • The band

Business hours, Monday to Friday This page’s arithmetic

Who is watching: pick a team to see the hours it covers

A business-hours team watches 50 hours of 168 (29.8%).

Nobody is watching for 118 hours (70.2%).

The band is 50 hours a week, so a launch time picked at random falls outside it 70.2% of the time, or 118 hours. One business day is 10 hours.

The band, the baseline and the two gaps are this page’s arithmetic from that definition. The yearly shares are Sophos’s, measured against its own band.

The grid shows which hours a band covers. It does not show when attacks happen: no source I read gives attacks by hour, and Sophos reports no preference among days of the week.

When ransomware was launched

The white tick is where a launch time picked at random would land. The circles are what Sophos saw.

Sophos, vendor data

83% of Sophos’s ransomware launches in 2024 were outside business hours: 12.8 points above a random launch time at 70.2%.

Sophos incident-response and MDR-service cases from 2024 (vendor data).

Sophos’s own cases, not a sample of all organisations. The 2024 count includes MDR-service cases and the earlier years do not, so the three bars are not a trend.

How fast, on a log scale

Each step along the axis is a longer unit of time, from seconds to a month, spaced on a log scale. Every mark says whether it is a mean, a median or one case, and whose cases it comes from.

How fast the intruder moves

Attacker progress, from four different measures.

How long before anyone notices

Defender discovery.

  • One business day, 10 hours This page’s arithmetic
  • Friday close to Monday opening, 62 hours This page’s arithmetic
  • Shapes: a circle is a median, a diamond a mean, a square the fastest single case.

Select a mark to see what it measures and whose cases it comes from.

Four different measures in three different populations. Breakout and hand-off are how fast an intruder moves; dwell time is how long before anyone notices. The lanes are never one series and the chart subtracts nothing: the point is the gap in orders of magnitude.

The week has 168 hours. Sophos (vendor data) counts business hours as 8 am to 6 pm, Monday to Friday: 50 of them. That leaves 118, which is 70.2% of the week, and that is where a ransomware launch time picked at random would fall. The band on the page is that arithmetic. It is this page’s, not Sophos’s, and if you move the band the baseline moves with it.

What Sophos saw is higher than chance. In its own incident-response cases (vendor data, not a sample of all organisations), 94 percent of ransomware payloads in 2022, 90 percent in 2023 and 83 percent in 2024 were launched outside the victim’s local business hours. In 2024 the lead over random was 12.8 points, and the 2024 cases include MDR-service customers that the earlier years do not, so I would not read the three years as a trend.

The second part is speed. CrowdStrike (vendor data) saw its fastest breakout, from the first machine to another, in 27 seconds, and an average of 29 minutes for criminal intrusions, which is a mean. Mandiant’s median hand-off from one group to another was 22 seconds. Sophos’s median time from the start of an attack to compromise of an Active Directory server was 0.46 days (about 11 hours) in 2024, again vendor data. Each of these is shorter than the 62 hours from Friday’s close to Monday’s opening, which is my arithmetic from Sophos’s hours.

The slowest mark is a different kind of thing. Mandiant’s median dwell time was 14 days in 2025, up from 11 in 2024. Dwell time is how long an intruder is present before anyone finds them, not how fast they move, and it comes from Mandiant’s investigations, a different population from CrowdStrike’s and Sophos’s. So the chart keeps the two lanes apart and subtracts nothing. What it shows is the gap in orders of magnitude, from seconds to days.

My viewMy reading, and it is a reading: when moves are measured in seconds and minutes and discovery in days, a team that is present for 50 of 168 hours has a coverage gap, and the gap is the other 118. A tool that is awake all week can close part of it; a person cannot. That is why I argue for constant monitoring, and why the rest of this series is about doing it with machines. It does not show that any particular attacker uses that gap on any particular night.

Exercise

Try it on your own week.

  1. Set the band to the hours someone at your business would actually see an alert and act on it.
  2. Read how much of the week that leaves outside the band, and compare it with the share Sophos saw.
  3. Pick one mark on the time axis and decide who or what would notice it, at three in the morning.

Sources

  1. Sophos, Active Adversary Report 1H 2024 It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024. 3 Apr 2024; 154 incident-response cases from 2023 (the title says 1H 2024, the data is 2023); read 2026-10-24.

    Read in full in a browser. Sophos’s own cases, not a sample of all organisations.

    • “Stats 4: Ransomware’s night moves”: business hours are 8am to 6pm local time, Monday to Friday
    • “Stats 4: Ransomware’s night moves”: the 2022 and 2023 shares
    • “Stats 4: Ransomware’s night moves”: 94 percent of ransomware deployments in 2022 fell outside business hours, only 6 cases inside
    • “Stats 4: Ransomware’s night moves”: 90 percent in 2023, 11 attacks inside local working hours

  2. Sophos, Active Adversary Report 2025 It takes two: The 2025 Sophos Active Adversary Report. 2 Apr 2025; 413 incident-response and MDR-service cases handled in 2024; read 2026-10-24.

    Read in full in a browser. Sophos’s own cases, not a sample of all organisations; the 2024 cases include customers of Sophos’s own detection-and-response service (MDR).

    • “Games without frontiers”: the 2024 share and its population of incident-response and MDR-service cases
    • “No time to waste”: median time to Active Directory compromise
    • Sophos reports no lingering preference among days of the week
    • “Games without frontiers”: 83 percent of ransomware deployments in 2024 fell outside business hours
    • “No time to waste”: median time to Active Directory compromise 0.46 days, about 11 hours

  3. CrowdStrike, 2026 Global Threat Report 2026 CrowdStrike Global Threat Report (press release). 24 Feb 2026; intrusions CrowdStrike observed in 2025; read 2026-10-24.

    The press release. How intrusions are selected and the average computed is not stated in what was read.

    • The 2026 Global Threat Report: fastest and average breakout time
    • The 2026 Global Threat Report: fastest breakout 27 seconds
    • The 2026 Global Threat Report: average eCrime breakout time 29 minutes

  4. CrowdStrike, 2026 findings CrowdStrike 2026 Global Threat Report findings (blog). 24 Feb 2026; read 2026-10-24.

    Used for the definition of breakout time.

    • Breakout time is the period between initial access and lateral movement onto another system

  5. Google Cloud, M-Trends 2026 M-Trends 2026: Data, Insights, and Strategies From the Frontlines. 23 Mar 2026; Mandiant investigations of 2025; read 2026-10-24.

    The blog post, not the full report. Mandiant’s cases are incident-response engagements, not a random sample of organisations.

    • “The Collapse of the Hand-Off Window”: the median hand-off time
    • “The Collapse of the Hand-Off Window”: the median fell from more than 8 hours in 2022 to 22 seconds in 2025

  6. Mandiant, M-Trends 2026 M-Trends 2026 Executive Edition. 2026; investigations 1 Jan to 31 Dec 2025; read 2026-10-24.

    The public executive edition, not the full report. Dwell time is a median, in days, over Mandiant’s targeted-attack investigations.

    • Page 3: global median dwell time 14 days, up from 11 days in 2024; dwell time is a median in days
    • Page 3: global median dwell time 14 days, up from 11 days in 2024

Everything here is paraphrased from the sources, not quoted at length, and each claim is attributed to one. A prediction is kept as its source’s prediction, with its hedge. Vendor figures and a vendor-sponsored study are labelled as such. Where a source is silent or could not be read, the page leaves the fact out.