Most cyber attacks don’t start with alarms or ransom notes.
The first signs are usually quiet.
They appear in the early hours of the morning when systems are idle and nobody is watching.
When we provide 24/7 cyber security monitoring for organisations at Black Swan Cyber Security Solutions, the alerts we see overnight rarely look dramatic.
They look small.
Almost routine.
Yet those small signals are often the first indication that someone has gained access they shouldn’t have.
The alerts that appear after hours
When an organisation shuts down for the evening, legitimate activity drops sharply.
That makes unusual behaviour much easier to detect.
Some of the most common alerts we see include the following.
Unusual login locations
A user account suddenly signs in from a country the organisation has no connection to.
Sometimes it’s obvious.
A staff member in Derbyshire appearing to log in from Eastern Europe or Asia within minutes.
Other times it’s less obvious. A sign-in from a hosting provider or anonymised network.
Either way, the question is the same.
Is this the real account owner, or someone using stolen credentials?
This is where Microsoft 365 threat detection becomes critical, because identity attacks often begin with a single successful login.
Repeated sign-in attempts
Another common signal is a burst of failed logins against a user account.
This can indicate attackers testing stolen passwords or attempting to guess credentials.
Given enough time, weak passwords will eventually fall.
Without monitoring in place, these attempts can continue overnight without anyone noticing.
Suspicious mailbox activity
Email accounts are frequently targeted once attackers gain access.
One of the most common alerts involves mail forwarding rules being created inside Microsoft 365.
An attacker quietly sets a rule to forward emails to an external address.
The account owner continues using their inbox normally, unaware their communications are being copied elsewhere.
This technique is widely used in invoice fraud and business email compromise attacks.
Devices contacting malicious infrastructure
Sometimes the signal comes from a device rather than an account.
A workstation or server attempts to connect to a domain known for malicious activity.
This could indicate malware, a compromised browser session, or software attempting to download additional payloads.
On its own, the alert may appear minor.
When combined with other signals, it can reveal the early stages of a breach.
Accounts behaving differently
Behaviour monitoring can also reveal activity that doesn’t match how an account normally operates.
Examples include:
Accessing administrative systems never used before
Downloading large volumes of files
Changing security settings unexpectedly
These actions often occur while attackers explore the environment.
Why attackers increasingly look like normal IT activity
A growing number of attackers now rely on tools that already exist within the environment.
Instead of deploying obvious malware, they often use legitimate remote administration software that IT teams rely on every day.
Because these tools are trusted and already have elevated permissions, their activity can appear legitimate.
This is something our partners at Huntress are observing across thousands of environments.
“Our Security Operations Center (SOC) team is seeing a significant shift in how cyber attackers operate. From 2025 to 2026, the misuse of remote management tools software commonly used by IT teams to manage devices has increased by 277%. Because these tools already have trusted, high-level access to systems, attackers are increasingly using them to blend in with normal IT activity.
By exploiting these legitimate tools, attackers can run commands, maintain system access, and move through company environments without immediately raising alarms. Without the correct security, this approach allows them to remain undetected for 10–12 days on average, giving them time to explore systems and position themselves before carrying out a major breach.”
– Sasha Roshan, Senior Sales Engineer, Huntress
This technique is often referred to as “living off the land.”
Attackers simply use the same tools administrators use.
From a monitoring perspective, this makes detection harder.
A remote command execution.
A configuration change.
A remote session.
Individually these actions might appear normal.
But when they occur at unusual times or from unusual locations, they start to form a pattern.
That’s exactly what 24/7 cyber security monitoring and managed detection and response are designed to uncover.
Why these early signals matter
One of the biggest misconceptions about cyber attacks is that ransomware appears instantly.
In reality, most attacks follow a sequence.
First comes access.
Then exploration.
Then privilege escalation and data access.
Only later does the visible damage appear.
By the time ransomware is deployed, attackers may have already spent days inside the environment.
Early signals provide the opportunity to stop them before that stage.
The challenge for smaller organisations
Large enterprises often operate full-time security teams and Security Operations Centres.
Most organisations do not.
Schools, nurseries, care providers, charities and small businesses typically rely on antivirus software, firewalls and IT support.
Those tools are useful.
But they rarely provide the level of visibility needed to detect suspicious activity at two in the morning.
If nobody is watching, the early warning signs can pass unnoticed.
Why monitoring makes the difference
Continuous monitoring changes the equation.
Instead of discovering problems after systems fail, unusual behaviour can be investigated immediately.
A suspicious login can be blocked.
A compromised account can be secured.
Malicious connections can be stopped before they spread.
At Black Swan Cyber Security Solutions, our monitoring services combine technologies such as Huntress Managed EDR and identity threat detection with continuous oversight from experienced analysts.
This allows organisations to detect threats earlier and respond before attackers gain momentum.
The reality of modern cyber security
Cyber security today is less about building walls and more about visibility.
Even well-protected organisations experience suspicious activity.
The key question is simple.
Does anyone notice in time?
Monitoring identity activity, endpoints and network behaviour provides that visibility.
It turns small signals into actionable alerts.
A simple question for your organisation
Most organisations assume their systems are quiet overnight.
The reality is often different.
If someone logged into your Microsoft 365 environment at 2:17am from a country you’ve never visited, would anyone know?
If a mailbox started forwarding sensitive emails externally, would it be detected?
If a device attempted to connect to known malicious infrastructure, would an alert be raised?
These are the kinds of signals we see regularly when monitoring environments.
They rarely look dramatic.
But they are often the first sign that something needs attention.
Want to know what your systems are doing overnight?
At Black Swan Cyber Security Solutions, we provide 24/7 cyber security monitoring and managed detection and response across the UK for:
schools
nurseries
care providers
charities
small businesses
Many organisations are surprised by what appears once proper monitoring is in place.
If you’d like to understand what might be happening inside your environment after hours, feel free to get in touch.
A short conversation can often reveal more than expected.
