Ransomware risk spikes on holidays and material events

At a glance

What this is: Semperis reports that ransomware activity rises on holidays, weekends and major corporate events, with staffing reductions and governance ambiguity creating the conditions attackers exploit.

Why it matters: IAM, PAM and SOC leaders need to treat reduced-coverage periods as a governance problem, because identity visibility, escalation paths and recovery decisions often weaken exactly when ransomware teams expect them to.

By the numbers:

• 52% of surveyed organisations were targeted on holidays or weekends, according to Semperis research.
• 78% of companies cut SOC staffing by 50% or more during holidays and weekends, according to Semperis research.
• 6% cut their SOC staffing entirely during holidays and weekends, according to Semperis research.
• 60% of attacks occurred after an IPO, merger or acquisition, or round of layoffs, according to Semperis research.

Context

Ransomware risk is not only a technical containment problem. When security coverage thins out, identity decisions, escalation paths and recovery ownership all slow down, which gives attackers more room to move.

This article is about the operational conditions that make ransomware more effective during predictable disruption windows. The underlying problem is governance drift: staffing, accountability and response readiness do not always keep pace with business calendar risk.

For identity programmes, the question is whether off-hours and event-driven coverage is designed into the operating model or assumed to be exceptional.

Key questions

Q: What breaks when SOC staffing drops during holidays and weekends?

A: Detection still works on paper, but response slows because the people who can validate alerts, revoke access and coordinate recovery are not fully available. That delay gives ransomware operators more time to expand access, disrupt systems and create business impact before containment begins. The failure is not visibility alone, but the gap between alerting and action.

Q: Why do mergers, acquisitions, and layoffs increase ransomware risk?

A: These events create ownership confusion, delayed access cleanup, and temporary permissions that outlive their purpose. Ransomware operators exploit that ambiguity because identity governance slows while the organisation is changing. The risk is highest where privileged accounts, third-party access, and recovery authority are not explicitly reassigned.

Q: How can organisations tell whether ITDR is actually helping against ransomware?

A: Look for whether identity detections are followed by enforced containment, named ownership and recovery completion. If alerts generate tickets but access remains active, the programme is only observing risk, not reducing it. Effective ITDR shortens the time between detection and removal of attacker advantage.

Q: Should organisations change ransomware response plans for holiday and event periods?

A: Yes. Plans that assume full staffing and normal approval speed often fail during predictable low-coverage windows. Organisations should pre-assign authority, test reduced-staff scenarios and make sure privileged identity actions can still happen quickly. The response plan has to reflect when disruption is most likely, not just when it is most convenient.

Technical breakdown

Why reduced SOC coverage changes ransomware outcomes

Ransomware operators benefit when defenders are least able to validate alerts, revoke access or coordinate containment. Reduced SOC coverage increases dwell time because triage queues grow, escalation takes longer and the people who know the environment are less available. In identity-heavy environments, that delay matters because account disablement, token revocation and privileged session termination are often the fastest ways to slow propagation. Holidays and weekends therefore change not the attack technique, but the defender's ability to interrupt it before encryption or exfiltration finishes.

Practical implication: build off-hours response coverage around identity actions that can actually halt spread, not just around alert acknowledgement.

Why material events create a governance window

Mergers, acquisitions, IPOs and layoffs create operational ambiguity, which ransomware groups exploit. The issue is not only distraction. It is also that ownership of systems, approvals, access rights and recovery decisions can become unclear at exactly the point when rapid action is needed. In practice, that means the usual chain of command for identity changes, privileged access decisions and incident approval can break down. Attackers do not need perfect access when governance itself is in transition; they only need confusion long enough to establish persistence or trigger disruption.

Practical implication: treat material business events as temporary governance-risk periods and pre-assign decision authority for identity containment.

ITDR still fails when remediation and recovery lag detection

The report shows that detection alone is not enough. Identity threat detection and response programmes can spot vulnerabilities, but if remediation and automated recovery are missing, the organisation still depends on manual intervention during a high-pressure incident. That creates a gap between knowing an identity problem exists and actually removing the attacker's advantage. For ransomware, that gap can be decisive because compromised identities, misused directories and disrupted recovery processes often outlast the initial alert. Detection without response and recovery is visibility without closure.

Practical implication: test whether identity detections trigger a full containment and recovery path, not just a ticket or dashboard alert.

Threat narrative

Attacker objective: The attacker aims to maximise disruption and business leverage by striking when detection, containment and recovery are least coordinated.

1. Entry occurs during periods of reduced staffing, when alert review and escalation are slower and attacker activity is less likely to be interrupted early.
2. Escalation follows as ransomware operators exploit the weaker oversight window to extend access, intensify disruption or reach systems needed for encryption and business impact.
3. Impact arrives when response and recovery are delayed, allowing the attacker to hold the environment longer and increase operational downtime.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Off-hours staffing is an identity governance decision, not just a SOC scheduling choice. When holiday or weekend coverage drops, the organisation is implicitly accepting slower identity revocation, slower approval paths and slower containment. That makes the coverage model part of the attack surface, not merely an operating preference. Practitioners should treat low-coverage periods as a defined control state with explicit identity response ownership.

Material corporate events create temporary authority collapse. Mergers, acquisitions, IPOs and layoffs do more than distract teams. They often blur who can approve access changes, who owns critical directories and who is authorised to make emergency containment decisions. Ransomware groups benefit from that uncertainty because delay is itself leverage. The implication is that event-driven governance needs pre-assigned control ownership, not ad hoc coordination.

Identity threat detection is only half a resilience programme if remediation remains manual. The report's ITDR findings show a common maturity gap: organisations can detect identity vulnerabilities but still struggle to remediate and recover quickly enough to matter. That leaves the attacker room to turn visibility into delay. The decisive variable is whether detection is tied to enforceable identity action, not whether alerts exist.

Holiday and event spikes expose an identity blast radius problem. The more an organisation depends on a small number of people to approve identity changes, the larger the blast radius when those people are absent or overloaded. That is a governance design flaw, not a seasonal inconvenience. The practitioner lesson is to shrink decision bottlenecks before the calendar creates them.

Named concept: coverage gap resilience. This is the failure mode where defender capability declines predictably during holidays, weekends or corporate transitions while attacker opportunity rises. It combines reduced staffing, slower escalation and uncertain accountability into a single exploit window. Security programmes that do not model this gap are assuming the business calendar is neutral, when it is often the attacker's timing advantage.

What this signals

Coverage gap resilience: Holiday and event-driven attack windows show that resilience has to be designed around reduced human availability, not ideal operating conditions. If identity containment depends on full staffing, then ransomware already has a timing advantage before the first alert fires.

Corporate transitions expose a second-order governance problem: the organisation may know who owns systems in steady state, but not who can act when ownership is changing. That is why event-specific delegation and recovery authority should be treated as core identity controls, not as temporary exceptions.

For practitioners

• Define off-hours containment ownership Assign named decision-makers for account disablement, privileged session termination and recovery approval during holidays and weekends, with clear delegation if the primary owner is unavailable.
• Pre-stage event-driven governance playbooks Create separate response runbooks for mergers, acquisitions, IPOs and layoff periods so access changes, escalation paths and exception approvals do not depend on informal coordination.
• Test identity response under reduced staffing Run exercises that simulate holiday coverage, including delayed triage, delayed approval and limited recovery staff, to see whether ransomware containment still works under realistic pressure.
• Tie ITDR alerts to enforced remediation Require every identity detection to trigger a containment action, a remediation owner and a recovery checkpoint so alerts do not stop at visibility.
• Review privileged access for event periods Audit which privileged accounts, break-glass paths and recovery roles remain available during business events, then remove any standing access that is not needed for rapid containment.

Key takeaways

• Ransomware operators benefit when defenders are least available to validate, revoke and recover, which turns holidays, weekends and corporate transitions into predictable risk windows.
• The report ties reduced staffing and governance ambiguity to attack timing, with 52% of organisations targeted on holidays or weekends and 60% hit after major business events.
• The control lesson is to pre-assign identity containment authority and test recovery under reduced coverage, so detection can still lead to action when staffing is thin.

Key terms

• Coverage gap resilience: Coverage gap resilience is the ability of a security programme to keep containment, approval and recovery functions effective when staffing drops or governance changes. It is a practical resilience measure for holidays, weekends and corporate events where attackers benefit from slower human response.
• Material event risk window: A material event risk window is the period around mergers, acquisitions, IPOs or layoffs when ownership, approvals and escalation paths can become unclear. In identity security, that window matters because delays in access decisions can create space for ransomware operators to act.
• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.