CYBCybersecurity

Breaches discovered late: why you need to look beyond your own perimeter

Many intrusions leave traces outside the company before they show any sign inside: credentials for sale, domains imitating the brand, suppliers that have been hit. Which signals to check and what to do when they appear.

Strategic editorial team 5 August 2026 8 min read

Cover: “Breaches discovered late: look outside”, Cybersecurity

How long does it take a company to notice a breach? It depends above all on who notices. According to Mandiant’s M-Trends 2026 report, in 2025 almost one intrusion in two (48%) was discovered by someone outside the targeted organisation. IBM’s Cost of a Data Breach 2026 report puts the average time to identify and contain a breach at 247 days. The first traces often appear outside the company: company passwords for sale, a domain imitating the brand, a supplier announcing it has been hit. Checking them methodically shortens the time between “it has happened” and “we know”.

How long does a breach stay hidden?

The figures in circulation differ because they measure different things. Dwell time is the period between the attacker getting in and being discovered.

Source	What it measures	Figure
Mandiant, M-Trends 2026	Median dwell time in intrusions investigated in 2025	14 days (11 in 2024)
Mandiant, M-Trends 2026	Same figure for espionage and for North Korean fake IT workers	122 days
Mandiant, M-Trends 2026	Who discovered the intrusion	52% the organisation itself, 48% an outside party
IBM, Cost of a Data Breach 2026	Average days to identify and contain a breach	247 days
IBM, Cost of a Data Breach 2026	Who discovered the breach	internal teams in about 4 cases out of 10, the attackers themselves in about 1 in 6

The gap between the two reports can be explained. Mandiant’s median includes ransomware attacks, which announce themselves with the ransom demand. IBM’s average also includes the time taken to contain the breach and, like any average, it rises with the longest cases. Silent intrusions, the ones that ask for nothing and steal data over time, can last for months. Three months is not a rule, but for these cases it is a realistic assumption.

What traces does an attack leave outside the company?

Stolen credentials. Programs called infostealers steal passwords saved in the browser, often from personal computers also used for work, and sell them on in bundles. Verizon’s DBIR 2025 report cross-referenced these bundles with the ransomware victims made public in 2024. In 54% of cases the company’s domain appeared among the stolen credentials, and in 40% there were company email addresses. Among the infected devices that held corporate logins, 46% were not managed by the company.
Domains imitating the brand. Registering a name almost identical to the company’s, with one letter changed or an extra hyphen, is called typosquatting. It is used to send fake emails to customers and employees. These domains show up in new registrations and in the public logs of security certificates (Certificate Transparency).
Secrets published by mistake. Access keys and passwords end up in public code repositories. According to the same Verizon report, fixing secrets exposed on GitHub took a median of 94 days.
Suppliers that have been hit. According to the DBIR 2026, a third party was involved in 48% of the breaches analysed, up from 30% the previous year. When a supplier with access to your systems announces an incident, the problem becomes its customers’ problem too.
Leak-site claims. Many criminal groups publish the names of the companies they have hit, with samples of their data, on dedicated sites, sometimes before the victim has understood what has happened.

Which signals should you check, and what should you do when they appear?

External signal	What it may mean	What to do within 24 hours
Company email addresses in a new collection of breached data	Passwords reused on an outside service	Change the password, check the second factor, review recent logins
Company credentials in an infostealer archive	An infected computer, possibly a personal one, and stolen sessions	Close sessions, issue new credentials, clean the device, review logins since the day of the theft
A domain similar to the company’s, with active email or a certificate	Email scams aimed at customers or employees in preparation	Alert staff, block it in the email filter, ask the registrar to suspend it with legal counsel
A key or password in a public repository	Possible access to cloud services	Revoke the key immediately (deleting the file is not enough), check the usage logs
A supplier announcing an incident	Shared access or data exposed	Suspend the supplier’s access, request written details, check the logs
The company’s name on a leak site	An intrusion has already taken place, and data has probably been stolen	Activate the incident response plan, involve legal counsel and the data protection officer

An external signal must always be compared with the internal logs: the logins on that account, data transfers, changes to permissions. That is where you find out whether a stolen password was actually used, as explained in Sherlock Holmes and the log files. And a single password used on several services may be all it takes, as the case of the reused password that opens every door shows.

How do you do it while staying within the law?

The method is called OSINT (open source intelligence). It means collecting and assessing information from public sources. Reading what is public about the company, its domains and its suppliers is lawful, provided the rules on personal data are respected. Investigating individuals on behalf of third parties is a different matter. In Italy it requires the licence provided for by Article 134 of the TULPS, Italy’s consolidated public security law. Buying stolen archives to see whether they contain your data is different again. It feeds the criminal market and creates legal problems.

The basic tools are within easy reach:

Breach notification services such as Have I Been Pwned, which, once the domain has been verified, send an alert when company addresses appear in new collections.
Certificate logs and new domain registrations, to spot domains imitating the brand.
Alerts from suppliers and authorities, from CSIRT Italia, Italy’s national computer security incident response team, to software vendors’ warnings.
Checks on code repositories belonging to the company and to its outside developers.

You don’t need to watch every minute. You need an agreed frequency for each source, someone responsible for receiving the alerts and a table like the one above that says what to do. For many companies the hardest part is not finding the signal. It is knowing who has to act and with what authority.

Where do NIS2 and the GDPR come in?

NIS2 is the EU directive on network and information security, Directive (EU) 2022/2555. Italy transposed it with Legislative Decree 138/2024. It does not require companies to check open sources. But among its risk management measures it requires incident handling, which the directive defines as all the actions taken to prevent, detect, analyse and contain incidents and to restore services. Organisations within its scope must send CSIRT Italia an early warning within 24 hours of becoming aware of a significant incident, the notification within 72 hours and a final report within one month. The deadlines run from the moment of awareness. Noticing sooner does not change the deadlines, but it means you reach them with more facts and less damage.

The GDPR runs on a separate track and applies to any organisation that processes personal data. A breach that poses a risk to individuals must be notified to the Italian Data Protection Authority (Garante) within 72 hours of becoming aware of it, where feasible. If the risk is high, the people affected must also be informed, without undue delay. For businesses in San Marino, the reference law on personal data is Law 171 of 21 December 2018. Everything else needs to be assessed case by case.

In brief

The time it takes to discover a breach varies widely. Mandiant’s median is 14 days, while IBM’s average to identify and contain a breach is 247 days.
Almost half of the intrusions Mandiant investigated in 2025 were discovered by an outside party.
Many traces appear outside the company first: stolen credentials, lookalike domains, published secrets, suppliers that have been hit, leak-site claims.
Every signal needs a source, a frequency, someone responsible and an action to complete within 24 hours.
The work uses public sources and lawful services, without investigating individuals and without buying stolen data.
NIS2 does not impose OSINT, but it does require you to be able to detect incidents. The GDPR has its own deadlines and recipients.

Frequently asked questions

How long does it usually take to discover a breach?

There is no single number. Mandiant reports a median dwell time of 14 days for the intrusions it investigated in 2025, rising to 122 days in espionage cases. IBM calculates an average of 247 days to identify and contain a breach. Attacks that demand a ransom are discovered quickly. Silent ones can stay hidden for months.

What is OSINT and what does it do for a company?

It is the collection and assessment of information from public sources: websites, domain registries, archives of breaches already made public, code repositories, communications from suppliers. For a company it helps to notice the signs of an attack early, such as company passwords in circulation or domains imitating the brand, and to check them against the internal logs.

If we find company credentials in a collection of breached data, do we have to report it?

Not automatically. First you check whether those credentials were used to get into your systems or to access personal data. If there was access, the assessment on notifying the Garante and, for entities covered by NIS2, CSIRT Italia is made immediately with legal counsel and the data protection officer, because the deadlines run from the moment of awareness.

Can we look for our own data on illegal marketplaces?

Consulting public sources and notification services is lawful. Visiting criminal marketplaces, buying stolen archives or investigating individuals raises legal and ethical problems. Anyone who needs deeper checks turns to specialist providers who set out the methods and limits of their work in writing.

Strategic supports companies on two fronts. With our Cybersecurity division, we check exposed systems and prepare the plan that sets out who acts when an external signal lights up. With our open-source review, we read what is published about the company and its brands, at an agreed frequency.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.