Here is the uncomfortable truth about breaches: they rarely announce themselves. The dramatic ransom note on every screen is the finale, not the opening act. Attackers typically live quietly inside a business network for weeks before doing visible damage, watching, collecting, and setting up. Which means the most valuable security skill a business owner can have is recognizing the quiet signs while there is still time to act.
Here are the eight we look for, in roughly the order they tend to appear.
1. Email rules you never created. This is the classic. Attackers who compromise a mailbox almost always create hidden inbox rules that forward or auto-delete certain messages, so you never see the bank’s fraud alert or the vendor asking why payment details changed. Check your inbox rules right now. If there is one you do not recognize, especially one deleting or forwarding mail, treat it as a five-alarm fire.
2. Logins from places your team is not. A sign-in from another country at 3 a.m. is not your bookkeeper being dedicated. Microsoft 365 logs every sign-in with location and device. Most businesses never look. The attackers count on that.
3. Colleagues receiving emails you did not send. If a client or coworker asks about a strange invoice or link “you” sent, your account is likely compromised and being used to attack the people who trust you. This is how one breached mailbox becomes ten.
4. MFA prompts you did not trigger. A push notification asking you to approve a login you did not attempt means someone has your password and is knocking on the last locked door. Never approve it out of annoyance. Attackers deliberately spam prompts hoping you will tap yes just to make them stop. That has a name, MFA fatigue, and it works far more often than it should.
5. Systems getting slow or accounts getting locked for no reason. Malware doing its work consumes resources, and attackers testing passwords trip lockouts. One slow laptop is a Tuesday. A pattern of slowdowns and mystery lockouts across the office is a signal.
6. New software or admin accounts nobody remembers creating. Attackers install their own tools and create their own accounts so they can get back in even if you change passwords. An unfamiliar admin account is one of the strongest indicators of an active intrusion.
7. Your data showing up where it should not. A customer mentions a scam call quoting details only you hold, or a security service flags your company credentials on the dark web. By this stage the breach already happened, and the question is how far it went.
8. Files changing, disappearing, or sprouting strange extensions. Ransomware encrypts in bulk, and the first symptom is often a folder of documents with garbled names or a mysterious new file extension. If you ever see this, disconnect the affected machine from the network immediately and get help. Minutes matter.
The part most articles will not tell you
Every sign above has something in common: it is visible in logs and alerts long before it is visible to a human going about their day. Microsoft 365 records the foreign login. The endpoint tool flags the strange process. The signal exists. The question is whether anyone is watching.
That is the honest difference between businesses that catch intrusions early and those that find out from the ransom note: not luck, but monitoring. It is exactly why we run an in-house 24/7 Security Operations Center for every client, because attackers deliberately work nights, weekends, and holidays, when nobody at your office is looking. If you want the plain-English version of how that layered detection works, our guide to EDR, MDR, and XDR covers it, and our cybersecurity services page shows the full picture.
Seeing one of these signs right now?
Do not wait to be sure. Early action is the whole game. We help businesses across Southern California, from Los Angeles to Orange County and San Diego, investigate suspicious activity, contain intrusions, and put the monitoring in place so the next attempt gets caught in minutes instead of months.