What Happens to a Business After a Data Breach: A Timeline From Exposure to Discovery

June 5, 2026 • BizVuln Expert

A data breach doesn't end with the moment of compromise—it begins. This post maps the critical timeline from initial exposure to discovery, revealing the hidden dwell time, attacker behavior, and business impacts, and shows how proactive threat intelligence can cut detection from months to minutes.

What Happens to a Business After a Data Breach: A Timeline From Exposure to Discovery

Every security professional knows the sobering statistic: the average time to identify a breach in 2023 was 204 days, according to IBM’s Cost of a Data Breach Report. But what actually happens during those 204 days? Far from a single catastrophic event, a data breach unfolds like a slow‑motion accident—a sequence of invisible steps that begin long before anyone inside the organization realizes they’ve been compromised.

For security consultants, MSSPs, and business owners, understanding this timeline is the first step toward shortening it. At BizVuln, we believe that threat intelligence isn’t just about knowing what threats exist—it’s about knowing when and where they strike. This post walks through the critical stages of a breach from the moment of initial exposure through eventual discovery, highlighting the forces that drive each phase and the warning signs that often go unnoticed.

The Pre‑Breach Reality: Why “Exposure” Isn’t the Same as “Compromise”

Before we map the timeline, it’s essential to clarify what we mean by “exposure.” In an MSSP context, exposure refers to any vulnerability, misconfiguration, or weak credential that an attacker could potentially exploit. The compromise—the actual breach—begins when that exposure is successfully weaponized. The gap between exposure and compromise? Often measured in hours or days, depending on the visibility of the asset and the sophistication of the adversary.

BizVuln’s continuous vulnerability scanning and threat intelligence feeds are designed to close that gap. But even the most hardened perimeter can be breached. When it happens, the clock starts ticking on a journey that most organizations are ill‑equipped to follow.

Phase 1: Initial Access – The Point of No Return (Day 0)

The breach timeline begins with a single successful intrusion. This could be:

• A phishing email that evades filters and credentials are harvested.
• An unpatched remote code execution vulnerability in a public‑facing web application.
• A brute‑force attack on an RDP endpoint that uses a reused password.
• A compromised third‑party vendor with privileged access to the network.

At this moment, the attacker gains a foothold—usually a low‑privileged account or a shell on an edge server. The organization’s security tools may or may not detect the initial compromise. If the attack is a known commodity (e.g., a commodity malware dropper), endpoint detection and response (EDR) might raise an alert. But sophisticated adversaries, especially nation‑state actors or advanced persistent threat (APT) groups, use custom malware, living‑off‑the‑land techniques, or credential theft that blends in with normal user behavior.

What the business sees: Nothing. Business as usual. The first alert, if any, is likely a low‑priority event that gets triaged and dismissed as a false positive.

Phase 2: Establishment & Dwell – The Silent Weeks (Days 1–100)

Once inside, the attacker’s priority is persistence. They install backdoors, create scheduled tasks, or modify legitimate system binaries to maintain access even if the initial vector is closed. This is the “dwell time” that security teams dread—the period when the adversary is quietly mapping the network, escalating privileges, and identifying high‑value targets.

During this phase, the attacker often:

• Uses built‑in system tools (PowerShell, WMI, PsExec) to move laterally without dropping new malware.
• Harvests credentials from memory using tools like Mimikatz or from domain controllers via DCSync attacks.
• Scans internal network shares and databases to locate sensitive data—customer PII, intellectual property, financial records.
• Disables or evades security controls by tampering with logging, killing EDR agents, or exploiting gaps in network segmentation.

This phase can last weeks or even months. The attacker is patient because they know that the longer they remain undetected, the more data they can collect. For many organizations, the only indication of a breach during this period might be subtle anomalies: unusual outbound data transfers, accounts logging in from atypical locations, or an uptick in failed authentication attempts—all of which can be missed in a sea of daily noise.

What the business sees: Possibly nothing. Some advanced SIEMs might flag lateral movement or anomalous authentication patterns, but without context or threat intelligence enrichment, these alerts often sit in a queue.

Phase 3: Lateral Movement & Privilege Escalation – The Spreading Infection (Days 30–150)

Armed with valid credentials and a foothold on several machines, the attacker moves toward the crown jewels. They seek administrative access to domain controllers, file servers, and databases. This stage is characterized by rapid scanning and exploitation of trust relationships—for example, using a compromised domain admin account to access every server in the domain.

Key indicators during this phase include:

• New service accounts or scheduled tasks created on multiple servers.
• Unusual RDP or WinRM connections between systems that previously had no communication.
• Large numbers of Kerberos ticket requests (a sign of kerberoasting or golden ticket creation).
• Disabling of security auditing or event logging on critical systems.

For an MSSP monitoring client environments, this is often where threat intelligence begins to prove its value. BizVuln’s threat correlation engine, for example, can tie together seemingly unrelated low‑severity events—a single failed login here, a registry change there—and map them to known attacker tactics, techniques, and procedures (TTPs) from the MITRE ATT&CK framework. Without that contextual intelligence, each event looks like a harmless hiccup.

What the business sees: Possibly no direct visibility. Some organizations may notice a performance degradation on file servers or an increase in help‑desk tickets about locked accounts—but these are rarely linked to a breach.

Phase 4: Exfiltration – The Point of No Return (Days 100–200)

Once the attacker has access to the data they want, they begin the slow, deliberate process of exfiltration. They may:

• Compress and encrypt sensitive files, then transfer them out via encrypted tunnels (HTTPS, DNS tunneling) to avoid detection.
• Use legitimate cloud services (Dropbox, Google Drive) to blend in with normal business traffic.
• Stage data on a single server before sending it out in small chunks over many days.

This is the most dangerous phase because the damage is now irreversible. Even if the breach is discovered moments after exfiltration ends, the data is already in the hands of criminals or competitors. From a regulatory perspective, exfiltration often triggers mandatory disclosure obligations under laws like GDPR, CCPA, or HIPAA, depending on the data type.

What the business sees: Unusual outbound traffic patterns—if they have network detection and response (NDR) tools. But many businesses do not monitor east‑west traffic or outbound SSL traffic effectively. In BizVuln’s threat intelligence feeds, we often see cases where exfiltration was only caught because the attacker accidentally triggered a DLP rule while moving a large file.

Phase 5: Discovery – The Moment of Truth (Variable)

Discovery rarely happens because of an internal alert. In fact, 67% of breaches are discovered by an external party—law enforcement, a third‑party threat intelligence provider, a customer, or even the attacker themselves (via a ransomware note or extortion email). The most common discoveries come from:

• An alert from a managed detection and response (MDR) service that correlates endpoint and network telemetry.
• A notification from a security researcher who finds stolen data on a dark web marketplace.
• An employee who notices suspicious activity (e.g., an admin account performing bizarre actions at 3 AM).
• A ransom demand that appears on screen after ransomware encrypts critical systems.

At this moment, the business moves from a state of ignorance to crisis mode. The incident response (IR) team is activated, forensic investigators are called, and communication with legal, PR, and regulators begins. The average cost of a breach jumps dramatically once discovery occurs because of containment, remediation, notification, and litigation expenses.

What the business sees: Chaos. A surge of panic from IT and legal teams. The immediate goal shifts to containment—isolating affected systems, preserving forensic evidence, and preventing further exfiltration.

The Aftermath: Lessons for MSSPs and Business Owners

The timeline from exposure to discovery is not fixed. It can be compressed from 200 days to just a few hours with the right combination of technology, process, and expertise. For MSSPs and security consultants, the key takeaways are:

• Visibility is everything. The longer the dwell time, the greater the damage. Deploy comprehensive logging across endpoints, network, and cloud environments. Use a SIEM with threat intelligence enrichment—like BizVuln’s platform—to reduce alert fatigue and surface genuine threats.
• Assume breach, but verify. Proactive threat hunting should be a regular practice, not a one‑off exercise. Hunt for signs of lateral movement, credential dumping, and unusual persistence mechanisms.
• Prioritize vulnerability management. Most initial access happens through known vulnerabilities that are left unpatched for months. BizVuln’s continuous scanning and risk‑based prioritization can help you close the exposure window.
• Test your detection and response. Run regular tabletop exercises and purple‑team engagements to see how quickly your team would spot an intrusion. Use real attack scenarios based on current threat intelligence.
• Build a relationship with external intelligence. Many breaches are discovered by outsiders. Subscribe to threat intelligence feeds, participate in sharing communities (e.g., ISACs), and consider an MDR partner that can monitor 24/7.

How BizVuln Shortens the Timeline

At BizVuln, our mission is to transform threat intelligence from a passive report into an active defense layer. Our platform correlates vulnerability data with real‑world exploit activity, providing MSSPs and business owners with actionable alerts the moment an exposure becomes dangerous. By integrating with SIEMs, EDRs, and SOAR tools, BizVuln flags the early signs of a breach—before the attacker has a chance to dwell, move laterally, or exfiltrate data.

We help our clients answer the key question: “Are we being targeted right now?” That answer, delivered in minutes rather than months, is the difference between a contained incident and a catastrophic breach.

Conclusion

A data breach is not a single event—it’s a process with a long, invisible tail. From the first successful phishing click to the moment the ransomware splash screen appears, the timeline is full of missed opportunities for detection. For security professionals, understanding this timeline is the first step in shifting from a reactive posture to a proactive one.

Whether you are a consultant advising clients, an MSSP managing dozens of environments, or a business owner responsible for your own data, the lesson is the same: shorten the timeline. Invest in visibility, intelligence, and continuous validation. Because when the clock is ticking, every day counts.

Want to see how BizVuln’s threat intelligence can help you detect breaches faster? Contact our team for a demo.