Look at when serious cyberattacks actually detonate and a pattern jumps out that no one should find surprising: Friday nights, weekends, holiday eves, 2 a.m. It’s not coincidence and it’s not superstition — attackers time the loud phase of an attack for when your office is empty, on purpose, because every hour without a defender responding is an hour they work uncontested. Which leads to the uncomfortable arithmetic at the heart of small-business security: your business is protected 168 hours a week or it isn’t, and a Monday-to-Friday defense covers about a quarter of the clock. Here’s why that gap matters so much, and what actually fills it.
The attacker’s schedule is a strategy
A modern intrusion isn’t a single bang — it’s a process: get in quietly, expand access over days or weeks, find the backups, then detonate. That structure gives defenders a window — the quiet middle phase throws off detectable signals (odd sign-ins, new forwarding rules, privilege changes, unusual process behavior) before anything visibly breaks. But the window only helps if someone is watching while it’s open, and attackers deliberately schedule the irreversible steps — mass encryption, the fraudulent wire, backup deletion — for the hours when nobody is. A ransomware job launched Friday at 11 p.m. gets an entire weekend of uninterrupted encryption; by Monday’s coffee, the question isn’t “how do we stop this” but “how bad is it.”
The same logic that makes attackers pick 2 a.m. is what makes 2 a.m. coverage disproportionately valuable: it’s not that more attacks happen then — it’s that the decisive moments are put there deliberately.
Minutes vs. hours is the whole ballgame
Modern endpoint tools can detect the behavior of an attack in progress — and, critically, can contain it: isolate a machine from the network in seconds, kill a session, cut the attacker’s access mid-move. Contained at 2:07 a.m., a compromise is one laptop quarantined and a ticket waiting at sunrise. Discovered at 8:30 a.m., the identical initial event has had six hours to become everything it wanted to be. The difference between those two Mondays isn’t the technology — both scenarios had the same tools. It’s whether a qualified human acted on the alert while it still described a beginning instead of an aftermath.
That’s the precise gap between owning detection software and having detection coverage: an unwatched alert console is a smoke detector in an empty building — it will faithfully record the fire.
What real 24/7 coverage is (and isn’t)
No small business can staff this itself — around-the-clock monitoring means multiple analysts across three shifts, weekends and holidays included, which is an enterprise payroll for a capability you need a few decisive minutes of per year. The practical answer is managed detection and response (MDR): a staffed security operations team watching many clients’ environments at once, triaging alerts, discarding the noise (most alerts are noise — which is itself a reason “we’ll watch the console ourselves” fails; alert fatigue is undefeated), investigating the real ones, and taking containment action immediately, with your IT looped in per an agreed playbook. It’s how a 20-person company gets the same night shift as a Fortune 500 — shared, which is the only way the economics work. It’s also why MDR is built into every one of our managed plans rather than sold as a premium add-on: detection without around-the-clock response was always half a product, and insurers’ claims data has led them to the same conclusion.
Buying it, ask the questions that separate staffed coverage from marketing: Who exactly is watching at 3 a.m. Sunday — people or software? · What actions will you take autonomously, and what wakes us up? · What’s the response time from alert to containment, in writing? “24/7 monitoring” sometimes means an unstaffed dashboard with excellent uptime; the word to insist on is response.
The bottom line
Attackers schedule their decisive moves for your empty hours because it works — the difference between an incident contained at minute five and one discovered at hour nine is roughly the difference between an anecdote and an event with a name. Around-the-clock human response used to be an enterprise luxury; MDR made it a line item any business can afford, and one the serious ones now treat as the floor. Your defenses shouldn’t keep better hours than your adversaries do.