Most breaches stay invisible for weeks because nothing visibly breaks. This guide explains why discovery comes so late and which data breach prevention steps surface intrusions early, drawing on current US incident data and the experience of our engineers supporting businesses across Texas and the Dallas-Fort Worth Metroplex.
Key Takeaways
- Attackers spent a median of 14 days inside compromised environments before detection (Mandiant M-Trends 2026).
- 52% of organizations detected the intrusion themselves. 34% were told by an outside party, and 14% found out from the attacker, usually via a ransom note.
- Across breaches of all kinds, identification alone took an average of 158 days (IBM Cost of a Data Breach Report 2025).
- Breaches contained within 200 days cost an average of $1.88 million less than slower responses.
- Stolen credentials (38%) and unpatched edge devices (29%) were the leading entry points in small-business ransomware breaches, and neither produces visible symptoms (Verizon DBIR 2026).
- The controls that prevent breaches and the controls that surface them early are largely the same list, starting with MFA, patching, and monitored endpoints.
Quick Answer
Businesses discover breaches late because modern attacks look like normal activity. Criminals sign in with stolen credentials or exploit unpatched edge devices, so systems keep running while data is exposed. The median gap between compromise and detection is 14 days, and businesses without monitoring often only find out when an outsider tells them. Effective data breach prevention pairs controls that block attacks, such as MFA and prompt patching, with the monitoring and logging that reveal the ones that get through.
How Late Is “Too Late”?
The best current numbers come from two places, and the difference between them is revealing.
Mandiant’s M-Trends 2026 report, based on incident response investigations conducted in 2025, puts global median dwell time at 14 days. Dwell time measures how long an attacker operates within an environment before being detected. When the business discovered the intrusion, the median was around nine days. When an outside party had to break the news, it was 25 days.
IBM’s Cost of a Data Breach Report 2025 looks at breaches of every kind, including those discovered long after the fact, and its averages are far worse: 158 days to identify a breach and another 83 days to contain it, a combined mean of 241 days.
Median days attackers stay hidden (Mandiant M-Trends 2026)
Average days to identify a breach (IBM Security, 2025
Of all breaches now involve ransomware (Verizon DBIR 2026)
Average savings when a breach is contained within 200 days (IBM)
The two reports measure different things, which explains the gulf between 14 days and 158. Mandiant counts intrusions serious enough to trigger a professional investigation. IBM averages across everything, including breaches that only surfaced when stolen data appeared somewhere public. The pattern holds in both: the attacker usually has far more time than the business realizes.
How breaches get discovered (share of cases, Mandiant M-Trends 2026)
| Detection source | Share of cases | Share |
|---|---|---|
| Detected internally | ██████████████████████████████████████████████████████ | 52% |
| External notification | ███████████████████████████████████ | 34% |
| Told by the attacker | ██████████████ | 14% |
Median days before detection, by who finds the intrusion
| Detection source | Median days to detection | Days |
|---|---|---|
| Found internally | █████████ | 9 |
| All intrusions | ██████████████ | 14 |
| Outside notification | █████████████████████████ | 25 |
Why Nothing Looks Wrong While It Happens
Modern intrusions rarely announce themselves, and small-business environments give them even less reason to.
Verizon’s 2026 Data Breach Investigations Report found that 38% of small-business ransomware victims were compromised through stolen credentials, and 29% through unpatched vulnerabilities in edge devices such as firewalls and VPN appliances. Neither method trips an alarm. A criminal signing in with a valid username and password appears to be an employee. An exploited firewall keeps passing traffic exactly as it did the day before.
The credential problem has a long fuse. Among ransomware victims with a prior credential-stealing malware infection, Verizon found that half had credentials stolen within the 95 days before the ransomware incident. That is roughly three months during which the theft was detectable, and the attack was still preventable.
This is why “everything seems fine” is such a poor security signal. Servers stay up, and email keeps flowing, right up until encryption starts. Stability tells you the systems are working. It tells you nothing about who else is using them. We cover what those first hours look like in our breakdown of the timeline of a breach.
"Almost every intrusion we investigate left traces in the logs days or weeks before anything visible happened. The businesses that catch attacks early are the ones where a specific person has the daily job of reading those signals."
Senior Security Engineer, CCS Horizon
The Cost of Finding Out Late
Speed changes the outcome more than almost any other factor. IBM found that breaches identified and contained within 200 days cost an average of $3.61 million, against $5.49 million for those that took longer. That $1.88 million difference reflects longer downtime, deeper attacker access, larger recovery projects, and higher legal and notification costs.
Late discovery also compresses legal deadlines. Texas businesses must notify affected individuals within 60 days of determining a breach occurred, and must notify the Texas Attorney General within 30 days if 250 or more Texas residents are affected. Healthcare organizations also face HIPAA’s federal notification rules. Every week an intrusion goes undetected is a week of forensic and customer communication work that now has to happen on a shorter timeline. Our IT compliance support page covers the frameworks in more detail.
For smaller businesses, the disruption side is usually worse than the legal side. Verizon found ransomware in 88% of small-business breaches, compared with 39% at larger organizations. A large company absorbs an incident; a smaller one often stops operating while it recovers. Our guide to how long ransomware recovery takes breaks down what that pause typically looks like.
Data Breach Prevention That Also Shortens Discovery
The useful insight in all of this data is that the controls that prevent breaches and the controls that surface them early are mostly the same list.
| Control | Why it matters for prevention and detection |
|---|---|
| Multi-factor authentication | Stolen credentials were the leading entry point for small-business ransomware. MFA on email, remote access, and admin accounts turns most of those attempts into failed logins that you can see. |
| Edge device patching | Firewalls and VPN appliances are exposed to the internet, and unpatched flaws in them were behind 29% of small-business ransomware breaches. |
| Monitored endpoint detection | EDR tools flag unusual behavior, but alerts only help if an engineer reviews and acts on them. This is the core of managed cybersecurity services. |
| Centralized logging | Sign-ins from unfamiliar locations, new admin accounts, and unusual data movement are all visible in the logs. Many businesses have the logs, and nobody is reading them. |
| Tested backups | Backups do not prevent a breach, but they determine whether it becomes an outage measured in days or weeks. See our approach to IT backup and recovery. |
| Routine access reviews | Old vendor accounts and former-employee logins widen the attack surface without anyone deciding to. |
None of this requires an enterprise security budget. It requires that the work be assigned to someone and checked consistently, which is the practical difference between a business that detects an intrusion within days and a business that gets a phone call from the FBI. For most companies with 10 to 100 staff, that consistency is the strongest argument for managed IT services with security built in rather than bolted on.
Where a Security Review Fits
Monitoring catches what happens from now on. It cannot tell you what is already true about your environment: which edge devices are missing patches, which accounts have no MFA, whether backups would actually restore, or whether credentials from your domain are already circulating.
That is what a structured review is for. CCS Horizon’s free Security & IT Health Check puts experienced engineers on your infrastructure, running vulnerability scans and reviewing configurations, then walking you through the findings in plain English. The full analysis typically takes around two days of engineering work and produces a specific list of gaps rather than a generic report. You can read more about our approach on the IT security services page.
Data Breach Prevention FAQs
Below are the questions business owners and IT managers ask us most often about breach detection and data breach prevention, with direct answers based on the current research.
Recent incident response data puts the median at 14 days between compromise and detection, but that covers intrusions serious enough to be professionally investigated. Across breaches of all kinds, IBM’s 2025 research found identification alone took an average of 158 days. Businesses with active monitoring and centralized logging sit at the fast end of that range. Businesses that wait for visible symptoms sit at the slow end.
In Mandiant’s M-Trends 2026 data, 52% of organizations detected the intrusion internally, 34% were notified by an external party such as law enforcement or a security vendor, and 14% learned of the breach from the attackers themselves, usually through a ransom note.
Common early indicators include sign-ins from unexpected locations or at odd hours, unexpected MFA prompts, new inbox rules that forward or delete mail, new user or admin accounts nobody remembers creating, and security tools being switched off. Each one can have an innocent explanation, which is why they often get dismissed. Centralized logging and regular review are what turn isolated oddities into a pattern someone notices.
Start with the two entry points behind most small-business breaches: enforce multi-factor authentication everywhere, and keep internet-facing devices such as firewalls and VPNs patched. Add endpoint detection with active monitoring, test backups regularly, and review who has access to what at least quarterly. A periodic independent security review then catches the gaps that day-to-day IT work misses.
Under Texas Business and Commerce Code § 521.053, businesses must notify affected individuals without unreasonable delay and no later than 60 days after determining a breach occurred. If 250 or more Texas residents are affected, the Texas Attorney General must also be notified within 30 days. Regulated industries can face additional federal requirements, such as HIPAA’s breach notification rule for healthcare organizations.
Find out what your systems are not telling you
If you cannot say with confidence how a breach in your environment would be detected, that’s worth knowing before it matters. CCS Horizon’s engineers will scan for the gaps attackers actually use and give you a clear, plain-English picture of where you stand.
Article Sources
- Mandiant/Google Cloud. M-Trends 2026 Report. Accessed July 7th, 2026
- Verizon. 2026 Data Breach Investigations Report. Accessed July 7th, 2026
- IBM Security. Cost of a Data Breach Report 2025. Accessed July 7th, 2026
- Texas Business and Commerce Code. § 521.053, Breach Notification. Accessed July 7th, 2026
- US Department of Health & Human Services. HIPAA Breach Notification Rule. Accessed July 7th, 2026.