Tech for Humans Newsletter

One of the biggest challenges with account breaches is how long they can go undetected.

If someone gains access to your Microsoft 365, Google Workspace, or email account, they often don’t start deleting files or sending spam. Instead, they quietly observe, gather information, and wait for the right moment to act.

According to the latest IBM Cost of a Data Breach Report, organizations take an average of 204 days to identify a breach and then another 73 days to contain it.

In other words, malicious activity can lurk in your system for nearly nine months before being managed.

Other industry data backs this up too: some organizations report that average dwell times, the time attackers remain in your system, can stretch to 280 days.

That’s more than two-thirds of a year in which attackers can poke around without being seen.

It also depends on the type of breach and the nature of the attacker. The most sophisticated ransomware gangs often remain hidden for months, corrupting backups, forcing victims to pay.

In some cases, they even search for the size of a company’s cyber insurance policy and then set the ransom to match. Nation-state actors and corporate espionage groups tend to linger even longer, siphoning off data.

On the other end of the spectrum, smaller ransomware gangs or hacktivists defacing websites usually operate much faster, going from breach to noticeable impact in days rather than months.

All that to say, you need to be aware of the potential signs of a breach. Here are some of the signs you should be looking out for.

Signs an Account Might Be Compromised

• New or changed multi-factor authentication (MFA) methods

Attackers may try to disable or change MFA to avoid triggering alerts.

• Unexplained account delegations or admin access changes

This can silently give someone else permissions they shouldn’t have.

• Unusual file downloads or uploads

Small changes, such as moving documents or exporting data, can signal data gathering.

• Notifications from external services

If shared documents or calendar items suddenly get comments or views from unfamiliar accounts, investigate.

• Unexpected alerts from apps or services

A benign alert to you may actually signal an attacker has triggered (and silenced) the alert.

• Changes to security or logging settings

If logs, alerts, or notifications suddenly stop working, it could be intentional sabotage.

What You Can Do This Week

• Enable MFA everywhere. Yes, it’s a chore sometimes, but it stops most account takeovers dead in their tracks.
• Weekly sign-in spot-checks. Look for weird hours, odd locations, or unfamiliar devices.
• Audit email rules and delegation. Any mysterious forwarding or admin rights? Remove them immediately.
• Set up alerts for logins from new devices, unusual locations, or multiple failed attempts.
• Log and monitor admin/security settings. An easy way to know if someone’s quietly disabling your defenses.

The longer an attacker stays inside, the more they can do and the more expensive it gets. IBM data shows breaches that go beyond 200 days cost significantly more, around $5.46 million on average, compared to breaches resolved more quickly.

Breaches don’t need to be high drama. In fact, the worst ones go completely unnoticed until it’s too late. But with clearer eyes on the signs and simple, reliable steps, you can spot them early.

If you’d rather not dig through logs yourself, we can handle it for you. We’ll monitor activity, watch for changes, and let you know the moment something looks off, so you're never left wondering if something’s hiding in plain sight.

All you have to do is reach out.