An Oracle E-Business Suite flaw exploited in August 2025, found in June 2026. The records were employees’: identity documents, bank details, health data.
Two years between the intrusion and the notification, on identity documents. Small organisations produce long intervals, and mostly go unrecorded.
A global shutdown days after detection. From outside it reads as catastrophe; inside an incident it is often the correct call.
A claimed source-code compromise at a security vendor. Code is not a signing key — but it is a map of the detection logic.
Education fails closed while other sectors degrade. The fix is not detection — it is an offline copy of the data needed to open safely.
A five-day difference in median dwell, attributable to who noticed. It is the strongest available case for spending on detection.
This database is a sample of long dwell times. Fast detection is exceptional here and apparently ordinary elsewhere.
Prevention will fail. Detection is what determines whether that becomes a state government offline for 28 days.
Furnaces have physical states that are expensive to leave. Stopping cost real money before the attacker did anything — and they stopped on detection.
Disclosing an attempt reveals detection capability. Holding it is not a compliance failure — it is the point.