Because the loud parts of an attack are easiest to run when nobody is watching. Initial access happens whenever a user clicks, but encryption, mass data theft, and account takeover are noisy operations. Attackers deliberately schedule them for nights, weekends, and holidays, when response teams are off shift and every passing hour is free progress.
enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT.
The attacker's logic
An intrusion has a quiet phase and a loud phase. The quiet phase, gaining access and moving laterally, is designed to look like normal activity. The loud phase, encrypting files or pulling data at volume, is impossible to hide from anything watching. So the attacker separates them: get in on Tuesday afternoon, wait, go loud at 2am Saturday. The gap between business hours and attack hours is a planned feature of the operation.
Time zones as a weapon
Many operators work from time zones where your client's 3am is their working day. Holiday periods concentrate the effect: long weekends give the loud phase days of runway before anyone logs in. None of this is bad luck. It is scheduling.
What this means for MSP coverage
If attackers choose the hours you are not watching, coverage limited to business hours defends the wrong window. The response is either genuine 24/7 operations or an honest conversation with clients about what happens overnight. What does not work is the middle position, where the contract implies around-the-clock protection and the reality is an unread queue until 9am.
Related Questions
What happens if ransomware hits overnight?
Can an MSP realistically monitor 24/7?
Scenario: A ransomware attack at 2am
