How would you know if someone was already inside your systems?
How would you know if someone was already inside your systems?
Most organisations expect cyber attacks to look obvious. Locked screens. Broken systems. Ransom notes. Panic.
The more uncomfortable truth is that many incidents start quietly. A stolen password. A Microsoft 365 login that looks legitimate. A device doing something unusual at 2am. Nothing crashes. Nothing looks broken. No one raises an alarm.
Most cyber attacks do not break in. They log in.
A growing number of incidents begin with legitimate access being used in the wrong way. That could be a stolen password, a compromised email account, a malicious mailbox rule, a remote access session or activity from a device that no one is watching closely.
From the outside, the business looks normal. Emails still send. Files still open. People carry on working. That is exactly why quiet compromise is so dangerous.
What we often see
- Microsoft 365 is heavily used, but sign-in behaviour is not actively reviewed.
- MFA is switched on, but suspicious account activity is still missed.
- Antivirus is installed, but no one is watching for behaviour that looks wrong.
- Devices are shared, portable or used outside normal working hours.
- There is no clear owner for investigating odd security alerts.
- The first sign of trouble is usually disruption, not early warning.
Traditional tools are better at spotting known threats than quiet behaviour.
Standard security tools can be useful. They may block malicious files, detect known malware and stop obvious attacks. The blind spot appears when someone uses valid access in a way that looks normal enough to avoid attention.
Valid logins
An attacker using a real username and password may not trigger the same alarm as malware.
Quiet persistence
Attackers may set things up to survive restarts, maintain access or return later.
Living off the land
Legitimate tools can be misused quietly, which makes activity harder to spot without behavioural monitoring.
If someone logged into your systems tonight, would anyone know?
- Would the login look unusual?
- Would device activity outside normal hours be spotted?
- Would suspicious mailbox changes be investigated?
- Would anyone know what to do next?
- Would the incident stay small, or would it sit there until it caused damage?
The difference is not panic. It is time.
When suspicious activity is spotted early
- Access can be removed quickly.
- Passwords can be reset.
- Devices can be isolated.
- Evidence can be preserved.
- The incident has a better chance of staying small.
When suspicious activity is spotted late
- Recovery becomes harder.
- The impact can spread.
- Trust takes a hit.
- Insurance and reporting questions become harder.
- The business is left asking why no one saw it sooner.
See if this blind spot applies to your organisation.
This is not a formal risk assessment. It is a quick visibility check. If you hesitate on more than one answer, that is worth talking through.
Quiet breach visibility check
Pick one answer for each question to get a simple readout.
Would we notice device activity outside normal hours?
Would we notice a compromised Microsoft 365 account?
Could we spot persistence on a device?
If something looked odd, who would investigate it?
If we suspected compromise, would we know what to do next?
How quickly would we want to know about suspicious activity?
Pick an option for each question to see a simple, non-technical readout.
If you hesitated on more than one answer, you are not alone. Many organisations are doing plenty right, but still lack visibility once someone logs in. Talk it through, no pressure.
We help you see the things that usually go unseen.
This is not about throwing more dashboards at you. It is about adding the right visibility, human review and clear guidance so suspicious behaviour does not sit unnoticed.
- Managed endpoint detection and response.
- Microsoft 365 identity threat detection and response.
- 24/7 monitoring options for higher-risk organisations.
- Incident response planning and first-step guidance.
- Support alongside your existing IT provider.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!