Under attack right now? Emergency incident response: a senior responder calls you back within 30 minutes, 24/7.
Quick answer: Attackers plan for the hours when nobody is watching. The Sophos Active Adversary Report 2026 found that 88% of ransomware was deployed outside business hours and 79% of data theft happened outside the normal workday. Many “24/7” services detect around the clock but rely on an on-call contact to act, so a Friday night alert can wait until Monday morning. ITSECOPS runs a staffed 24/7 delivery center in Noida, India: weekend and night alerts are triaged and contained then and there, under a runbook you approved in advance, and you get a full report on Monday instead of a crisis.
Why this matters now
- 88% after hours. In the Sophos Active Adversary Report 2026 (661 cases across 70 countries), 88% of ransomware deployments happened outside business hours, and the median time for attackers to reach Active Directory was 3.4 hours.
- Weekends are when defenders thin out. A Semperis survey published in November 2025 found that 52% of organisations were hit on a weekend or holiday, and 78% cut their SOC staffing by half or more during those periods.
- Recent weekend events. Two Citrix NetScaler zero days were confirmed as exploited on Sunday 27 September 2026, with administrators told to patch or take appliances offline. UK fashion group TFG London detected a cyber incident on Sunday 11 October 2026 that disrupted websites, order processing and stock visibility for Phase Eight, Hobbs and Whistles.
- The holiday season is next. US Thanksgiving falls on 26 November 2026, followed by Black Friday, Christmas and New Year: the longest stretch of the year with skeleton IT teams.
The Monday morning problem
| Time | Detection with on-call escalation only | ITSECOPS staffed 24/7 response |
|---|---|---|
| Friday 23:40 | Alert fires, email and page sent to the on-call contact | Alert fires, analyst on shift starts triage |
| Friday 23:55 | On-call phone is on silent; endpoint isolated if the agent saw it | Compromised account disabled, sessions revoked, attacker IP blocked per runbook |
| Saturday 03:00 | Attacker moves to a server with no agent | Scope checked across identity, servers, firewall and backups; no spread |
| Sunday | Data exfiltration and encryption staged | Root cause found and closed, hardening applied |
| Monday 09:00 | IT team arrives to an outage | You read a written incident report with timeline and actions taken |
How ITSECOPS covers nights, weekends and holidays
- Staffed shifts, not a pager. Our 24/7 delivery center in Noida, India is staffed around the clock, including Fridays, Saturdays, Sundays and public holidays. Friday evening in New York is early Saturday morning in India, and Friday night in London or Oslo is the early hours of Saturday in India, so your quietest hours are covered by a working shift.
- A runbook you approve in advance. We agree with you what we may do without waking anybody up (disable an account, revoke sessions, block an address, isolate a host) and what needs a call (shutting down a production system).
- Response beyond the endpoint. Identity, email, firewall, VPN, servers and cloud are in scope, so we can act on the parts of an attack an endpoint agent cannot see. See the next layer after your MDR.
- Under 15 minutes to first triage. Our target for acknowledgement and first triage of a high severity alert is under 15 minutes, on a Sunday at 03:00 the same as on a Tuesday afternoon.
- Monday is for the report, not the firefight. You receive a written summary: what happened, what we did, what still needs a decision.
The same staffed coverage applies to IT incidents out of hours, such as a server down, a failed backup or a locked out executive: see after hours IT support and on-call engineers. Local offices in Kansas City, USA and Stavanger, Norway handle account management and escalations in your time zone.
Frequently asked questions
Are cyberattacks more likely on weekends and at night?
Yes. Most ransomware is deployed outside business hours (88% in the Sophos Active Adversary Report 2026) because attackers know response is slower when staff are away. Weekends and public holidays are the most targeted periods.
What should happen if we get hacked on a Friday night?
Within minutes: confirm the alert, disable compromised accounts, revoke sessions, block the attacker’s access and isolate affected devices. Within hours: check identity, servers, firewall and backups for spread. Then find the root cause and close it before Monday. If nobody in your organisation or your provider is awake to do that, the attacker has the whole weekend.
Does our MDR actually respond on weekends, or only alert?
Ask your provider two questions: who acts at 02:00 on a Saturday, and can they act outside the endpoint, for example on identities, email and firewalls? Many services isolate the device automatically or on analyst approval and send the rest to your on-call contact.
Does a small business need a 24/7 SOC?
If an outage over a weekend would stop sales, operations or patient care, yes. Shared 24/7 SOC coverage starts at $300 to $900 per month for up to 25 endpoints: see SOC as a service pricing.
How do you handle Thanksgiving, Christmas and New Year?
The same as any other day. Our delivery center runs a full roster through US, UK and European holidays, which is exactly when in-house teams and many providers run on skeleton staff.
What can ITSECOPS do without waking us up?
Whatever your runbook allows. Most clients pre-approve account disabling, session revocation, IP blocking and host isolation, and ask to be called before production systems are shut down or restored.
Which time zones do you cover?
All of them, 24 hours a day. Analysts work in shifts from Noida, India, with offices in Kansas City for North America and Stavanger for Europe.