Security vendors love to say “attacks happen at 2 a.m.” — and it’s true, and deliberate — but the claim stays abstract until you walk through the minutes. So here’s the same attack, twice: one business with around-the-clock monitored response, one without. Both are composites of the pattern we and every security team see repeatedly; neither is exaggerated. The initial event is identical in both tellings. The Mondays are not.
The setup, common to both
Tuesday, weeks earlier: an employee’s password is phished. Since then, quiet reconnaissance — the attacker has mapped the network, harvested more credentials, located the backup server. Tonight, Friday, 1:58 a.m., they begin the loud phase: connect via the stolen account, escalate to an admin credential, and start staging ransomware — a burst of distinctive behavior: an admin account active at a dead hour, credential-dumping tools running, unusual connections fanning out toward servers.
Business A: monitored, 24/7
2:01 a.m. — EDR on the first touched machine flags credential-theft behavior. The alert doesn’t wait in a console; it lands with an on-duty analyst at the MDR operations center.
2:04 a.m. — The analyst pulls the machine’s recorded timeline, sees the pattern (odd-hour admin activity, dumping tool, lateral movement starting), and calls it: real, active, now. No debate about waking anyone — that’s the entire premise of the service.
2:06 a.m. — Containment: the affected machines are isolated from the network with a click, the compromised accounts disabled, active sessions killed. The attacker’s connection dies mid-keystroke. The staging never detonates; the backup server was next on their list and is never reached.
2:20–7:00 a.m. — The analyst sweeps for persistence (extra accounts, forwarding rules, scheduled tasks), confirms containment, and documents the timeline. The client’s IT lead gets the call per the playbook.
Monday — Two machines get reimaged, every credential the attacker touched gets rotated, the phishing that started it becomes this month’s training example, and leadership reads a one-page report about the incident that didn’t happen. Total business impact: two workstations offline for a day. Most employees never know.
Business B: same attack, empty building
2:01 a.m. — If EDR is present, the same alert fires — into an unwatched console. If it’s traditional antivirus, nothing fires at all; nothing here matches a known-malware signature. Either way, no human moves.
2:15 a.m.–5:00 a.m. — Uncontested, the attacker works the checklist: reach the backup server, delete or encrypt every reachable copy, copy out the interesting data for the second extortion angle, then launch encryption across the servers and shares. The timing wasn’t luck — Friday night buys the longest possible runway; the whole weekend, if the business is closed.
Monday, 7:40 a.m. — The first person in can’t open anything. The ransom note names a deadline. Now the clock that should have started at 2:01 a.m. Friday starts — 78 hours late: the call list, the insurer’s breach hotline, forensics. The first questions — what did they take, when did they get in — get answered slowly or never, depending on what logging existed and how long it was kept.
The following weeks — Recovery becomes whichever story the backups permit: restore from the offsite immutable copy if one survived, or a negotiation with criminals if it didn’t. Either way: days-to-weeks of degraded operation priced at the down-day number, recovery labor, possible notification obligations, an insurance claim scrutinized against what the application promised, and a version of events clients will hear about.
The uncomfortable, useful conclusion
Read the two timelines again and notice what didn’t differ: the phish, the attacker, the tools, even (in the EDR case) the alert. The entire divergence — two workstations versus the whole company — happened between 2:01 and 2:06 a.m., and it was purchased in advance, as a service, for a monthly line item that rounds to a fraction of Business B’s Monday. That’s the honest case for 24/7 response, and it’s why we build MDR into every managed plan instead of selling it as an upgrade: the 2 a.m. attack isn’t the rare scenario. It’s the designed one — and the design assumes your building is empty. The only question the attacker can’t control is whether that assumption holds.