Alliance is "Don't Make It Easy for Them." For individuals, that usually means strong passwords, multifactor authentication, and a healthy suspicion of unexpected links. Those habits matter.
For organizations, the easiest thing you can hand an attacker usually isn't a weak password. It's time: the hours when nobody is watching.
The attack happens at 2 a.m. for a reason
Sophos's 2026 Active Adversary Report analyzed 661 incident response and managed detection cases from late 2024 through 2025. The timing pattern was hard to miss. In 88% of ransomware cases, the payload was deployed outside business hours. Data theft followed the same pattern, with 79% of exfiltration activity happening off-hours.
That's not a coincidence. Ransomware operators plan around staffing. They know encryption and large data transfers are far more likely to finish uninterrupted on a Saturday night than on a Tuesday morning, and they schedule accordingly.
Attackers move faster than a Monday morning review
The same report found that identity-related techniques like phishing, brute force, and stolen credentials accounted for 67% of initial access. Once inside, attackers reached Active Directory in a median of 3.4 hours.
Think about what that means in practice. An alert that fires at 11 p.m. on a Friday and gets reviewed first thing Monday hasn't bought your team a head start. It's given the attacker an entire weekend to escalate privileges, disable defenses, and stage the payload.
Why manufacturing and healthcare feel this most
Manufacturing plants and healthcare organizations share an uncomfortable mismatch: their operations run around the clock, but their security coverage often doesn't.
- Manufacturing runs shifts, weekend production, and connected OT environments where downtime stops the line and ripples into the supply chain. Sophos tracked 99 distinct threat groups targeting manufacturers over the past year.
- Healthcare never closes. Clinical systems, patient records, and connected medical devices need to be available at 3 a.m. just as much as at 3 p.m. Sophos identified 88 different groups targeting healthcare organizations.
In both sectors, the business is operating 24/7. Attackers are betting the security team isn't.
The tools usually aren't the gap. Coverage is.
Most mid-sized organizations aren't short on security products. They have endpoint protection, firewalls, maybe a SIEM, and a growing pile of cloud and identity logs. The problem is what happens when those tools fire.
A small internal team can't triage every alert during the day and stay on call every night, weekend, and holiday. Staffing even one seat around the clock takes multiple full-time analysts, and that's before vacations, turnover, and the steady burnout that comes with alert fatigue. So alerts wait. And attackers count on the wait.
What "don't make it easy" looks like for detection
Making it hard for attackers after they get in comes down to a few practical capabilities.
Watch identity first. With most intrusions starting with stolen or abused credentials, unusual sign-ins, privilege changes, and activity around Active Directory deserve the closest attention.
Correlate across everything. An odd login, a new scheduled task, and an outbound transfer may each look minor alone. Together, they're an attack in progress. Detection works when endpoint, network, cloud, and identity data are analyzed together instead of in separate consoles.
Respond, don't just alert. An alert nobody acts on is a log entry. Effective detection includes the authority and the process to isolate a host or disable an account within minutes, at any hour.
Cover nights, weekends, and holidays. The upcoming holiday season is a predictable window for off-hours attacks. Coverage plans should assume the attacker has read the calendar too.
It also helps to know what attackers see from the outside before they ever get in. An External Attack Surface Assessment shows which exposed systems and credentials are most likely to become that first foothold.
How managed detection closes the gap
This is where Managed XSIAM fits. Tec-Refresh delivers Palo Alto Networks Cortex XSIAM as a fully managed service: the platform that brings endpoint, network, cloud, and identity data together, plus the analysts who monitor, investigate, and respond around the clock.
For a manufacturer or a healthcare organization, that means a confirmed threat at 2 a.m. gets contained at 2 a.m., not discovered at 8. Your internal team keeps ownership of the environment and the business context. Our SOC team makes sure nobody gets a free weekend inside your network.
Make it hard, at every hour
"Don't make it easy for them" is good advice for every employee with an inbox. For the organization as a whole, the most important version of that advice is simple: don't leave the room empty.
Attackers already know when your team logs off. The question is whether anyone is watching when they log on.