The average dwell time for an attack is 280+ days. That’s because threat actors understand that most organizations only monitor the edge and crown jewels (data centers, ingress/egress points, or strategically sensitive areas). As such, our adversaries find ways to compromise a network through approved services and with approved credentials.
They hide in an unmonitored corner of the network and move in ways that avoid attention and detection.
Just as your business is reliant upon the network, so are threat actors. Cybercriminals need to use the network to execute their objectives. Each move made by a threat actor can be seen, if you’re watching closely enough and have a complete picture of what “normal” looks like.