At 18:40 on a Friday the last person in the office closes a laptop. At 02:15 on Saturday a service account nobody has used since a 2023 migration starts touching file shares in an order no human would choose. Encryption begins around 04:00. The first person to notice is a warehouse supervisor on Monday, wondering why the picking system will not load.
Nothing in that story required a sophisticated attacker. It required a calendar.
The numbers are not subtle
Sophos looked at 661 incident response cases in its Active Adversary Report 2026: in 88% of ransomware cases, encryption was deployed during non business hours, with 79% of data theft following the same pattern. Mandiant found 76% of deployments outside work hours, most in the early morning. The FBI and CISA thought the pattern clear enough to publish a standing advisory about holidays and weekends.
What decides when you get encrypted is not your patch level. It is your rota.
They are hiding from your people, not your tools
Out of hours deployment gets described as evasion, as though a sensor sleeps. Your sensors do not sleep. Alerts still fire at 04:00. They land in a channel and sit there.
What the weekend changes is everything after detection. The person who can disable an account is at a wedding. The backup admin's phone is in a kitchen drawer. Your MSP's out of hours line can open a ticket but cannot touch your tenant. The break glass credential is in a safe, in an office, locked until Monday.
Sophos put the median time from intrusion to Active Directory compromise at 3.4 hours, and median dwell time at 3 days. That is the whole problem in one line: hours of attacker progress against a response process measured in days. The way in is rarely exotic either, with identity related techniques at the root of 67% of cases. Usually a stolen session token, which is how attackers walk straight past MFA.
Five things that hold while nobody is watching
Backups your own admin account cannot delete. Not "we back up nightly". The test is whether someone holding domain admin, or the cloud equivalent, can delete the backup or shorten its retention. If it lives in the same tenant under the same identity, it is a copy, not a recovery plan.
A break glass account opened this quarter. Most tenants have one. Few have tested it. MFA on a device somebody can reach at 03:00, and a credential retrievable without entering the office, or it is a story rather than a control.
An alert path that ends in a ringing phone. An alert in a channel is a log entry with better formatting. Write down, in one line, who may disconnect production at 04:00 on a Sunday without asking anyone. If that line does not exist, nobody will do it.
Session revocation, not just a password reset. Resetting a password does not invalidate a live token. Revoke sessions, rotate refresh tokens, disable the account: three different clicks, and at 4am people do the first and assume the rest.
A restore you have actually run with a stopwatch. Most teams discover their real recovery time during their first real incident, which is a bad moment to find out.
A twenty minute test, best run on a Saturday
- If an alert fires now, whose phone rings? Call it and see.
- Can that person disable an account on their own authority, from wherever they are?
- Can you get the break glass credential without going to the office?
- Could an attacker holding your most privileged account delete your backups? Not certain means no.
- When did anyone last restore a real system, rather than read a backup job that said success?
Four uncomfortable answers out of five tells you more about your weekend exposure than any dashboard was going to.
Three of those five are configuration, and configuration can be read on a Thursday instead of discovered on a Monday: whether the backup vault carries an immutability lock and who can remove it, whether privileged roles are standing or time bound, whether the break glass exclusions are still where you left them. SecValley scans read only across Microsoft 365, Entra ID, Azure, AWS, Google Cloud, Google Workspace and GitHub, and every check returns a value with the date it was read.
The attackers already know what your Friday looks like. It seems fair that you should too.
Frequently Asked Questions
Do we need a 24/7 security operations centre?
For most mid sized organisations, no. A SOC improves detection, and detection is usually not the failing part. A named on call person with real permissions and a tested runbook closes more of the gap for far less money.
If encryption starts at 04:00, is it already too late?
The encryption is the last step of an intrusion that started days earlier. Mandiant put the median gap between initial access and deployment at around six days. The weekend is when the payload runs, not when the attacker arrives, which is why earlier signals like lateral movement are the ones worth catching.
What single control protects a weekend best?
Backups the attacker cannot reach with stolen credentials. It does not prevent the incident, it converts a ransom negotiation into a restore.
