88% of Ransomware Is Deployed Outside Business Hours. Your Monitoring Stops at 6 PM.

Most ransomware is deployed at night and at weekends, when tools still run but nobody answers them. Real 24/7 security monitoring needs four things beyond a dashboard: a behavioural baseline, a narrow set of high-signal alerts, a named response time by severity, and an escalation path with the authority to act at 04:00.

The Sophos Active Adversary Report 2026, which analysed 661 incident response and managed detection cases across 70 countries between November 2024 and October 2025, found that encryption was deployed outside normal business hours in 88% of ransomware cases. Data theft followed the same curve, with 79% of exfiltration activity happening outside the standard workday.

This is not a coincidence of time zones. It is a targeting decision. The attacker is choosing the window in which your team is smallest, your escalation path is slowest, and the person who would recognise the anomaly is asleep. Everything else in their playbook is opportunistic. The timing is deliberate.

Set that against how most mid-sized companies actually operate. Monitoring tools run continuously. The humans who act on them work roughly 40 hours out of 168. That leaves about 76% of the week covered by software that can raise an alert and nobody positioned to answer it.

Mandiant's M-Trends 2026, based on more than 500,000 hours of incident response in 2025, reported global median dwell time rising to 14 days from 11 the previous year. Two other findings from the same report matter more for how you plan.

The first is speed at the front of the attack. Mandiant documented handoffs between an initial access actor and the follow-on operator compressing to as little as 22 seconds. The old mental model, where an intrusion sits quietly for weeks before anything happens, no longer describes the fast-moving cases.

The second is what the intruder now targets first. M-Trends 2026 describes a shift toward recovery denial, where ransomware operators deliberately attack backup and disaster recovery infrastructure to extend the remediation window and strengthen their negotiating position. Backup jobs being disabled, retention policies being altered, or replication being broken are no longer housekeeping events. They are late-stage attack indicators. That is also why an untested backup is not a recovery plan: if the attacker reaches it first, the restore path you assumed was there is gone.

The two datasets are worth reading together rather than against each other. Mandiant's 14-day median covers all intrusion types and is pulled up by long espionage cases. In the Sophos set, which is weighted toward ransomware and hands-on intrusion, median dwell time was three days, and the median time from initial access to reaching Active Directory was 3.4 hours. Planning your detection cadence around the higher number is planning for the wrong half of the distribution.

Most companies that describe themselves as monitored are alerting. The distinction is worth being precise about, because it determines whether the tooling produces an outcome or a log line.

Alerting means a rule fired and a message was delivered to a channel. Monitoring means a person or an on-call rotation with authority received it, judged it, and acted within a defined time.

Three failure modes turn the first into a false sense of coverage:

Under Article 23 of NIS2, entities in scope must submit an early warning to their CSIRT or competent authority within 24 hours of becoming aware of a significant incident, a fuller incident notification within 72 hours, and a final report within one month.

If you are unsure whether your company falls in scope, a NIS2 applicability assessment answers that before the question arrives from a regulator.

The mechanism deserves attention. The clock is tied to awareness. An organisation that detects an intrusion on day nine has a 24-hour reporting obligation starting on day nine, and a considerably harder conversation about why nine days passed. Regulators, insurers, and enterprise customers all now ask the same follow-up question: what monitoring was in place, and who was watching it.

Cyber insurance underwriting has moved in the same direction. Continuous monitoring, logging retention, and a documented response time are standard questionnaire items, and the answers affect both premium and the scope of what is covered.

If you are evaluating whether your current setup would catch a Sunday morning intrusion, five components decide it.

On standard shift-planning arithmetic, continuous coverage of a single seat needs about 4.2 full-time equivalents before absence is accounted for, and roughly five once annual leave, sick days, and public holidays are included. At European salary levels, that is a security operations budget most companies with 20 to 200 employees will not approve, and correctly so, because the same money spent on a senior engineer building controls usually reduces more risk.

This is the practical reason monitored services exist at this size of company. Not because in-house teams are less capable, but because the coverage requirement is a staffing problem before it is a technology problem, and staffing does not scale down gracefully. What you should insist on either way is that the outcome is specified rather than the tooling: a named response time, a defined escalation path, and a monthly report that shows what changed.