Not every incident announces itself with a ransom note. Here are the signs worth taking seriously, on both the technical and business side.
Technical indicators often show up in account activity and system behavior before anything more dramatic happens. Unexpected account lockouts, password reset emails you didn't request, or new admin accounts nobody recognizes are all worth investigating immediately rather than dismissing as noise.
Unusual outbound network traffic, especially at odd hours when normal business activity should be minimal, is another pattern worth watching — it often indicates data being exfiltrated or a compromised system communicating with external infrastructure.
Sometimes the first sign isn't technical at all — it's a customer or partner noticing something wrong before your own team does. Customers reporting suspicious emails that appear to come from your domain, or vendors flagging unusual requests, are both worth investigating immediately rather than assuming it's someone else's problem.
Unexplained financial transactions or invoice changes can also indicate a business email compromise, where an attacker has gained access to communications and is using that access for fraud rather than obvious technical disruption.
Don't wait for certainty. Isolate what you can without destroying evidence, and get a response team involved early — the cost of overreacting to a false alarm is far lower than the cost of reacting too late to a real one.
If you're not sure whether something warrants a full response, a short triage conversation with a response team can usually clarify quickly, without committing to a full engagement before you know it's actually needed.
Treat ambiguous signs as worth a second look rather than dismissing them. A short triage call can usually tell you quickly whether it warrants a full response, without the cost or disruption of a full engagement.
It depends on what you actually know and what regulations apply to your business. Getting a response team involved quickly helps you make that communications decision with better information rather than reacting on incomplete facts.
Yes, some of them commonly are — but the cost of investigating a false alarm is far lower than the cost of dismissing a real one, which is why we recommend erring toward investigation.