In every case analyzed, initial access came through a legitimate account - a VPN login, an RDP session, an internal user account. The entry appeared as normal activity. By the time anomalous behavior surfaced, the attacker had already established a foothold and begun moving laterally through the environment.

Attacks begin with valid credentials

The majority of confirmed incidents occurred at night, on weekends, or during periods when the personnel responsible for response were unavailable. Attackers do not only target technical vulnerabilities but also the moments when an organization's capacity to respond is at its weakest - and they plan accordingly.

Timing is deliberate, not coincidental

Attacks move in real time. Internal response still follows a sequential process: confirm the event, share internally, evaluate options, seek approval, then execute. Each step consumes time the attacker is already using. In environments where this gap exists, even accurate detection does not prevent escalation.

Attackers outpace internal response

Across all 6 cases, the organizations had security systems in place. The factor that determined the scale of damage was the same in each instance: limited response authority, approval-dependent decision structures, and ambiguity around who acts, and when, once a threat is confirmed. Security existed but the structure to act on it did not.

The determining factor is structural