The preparation phase leaves most threat tooling looking too late

At a glance

What this is: This is a Silent Push analysis of the preparation phase, the pre-attack infrastructure staging period that traditional detection and threat intelligence tools usually miss.

Why it matters: It matters because IAM, NHI, and SOC teams cannot rely on event-driven telemetry alone when adversaries build their infrastructure long before any observable incident exists.

By the numbers:

• The average early-detection lead time from that process is 104 days ahead of a traditional SIEM alert.
• For Advanced Persistent Threat campaigns, the lead time has exceeded 300 days.

Context

Preparation phase visibility is the gap between infrastructure being built and infrastructure becoming malicious. In this phase, actors can register domains, stand up servers, configure DNS, issue certificates, and test their setup before any overt attack signal exists, which means many conventional controls only start working after the campaign is already live.

Threat intelligence, SIEM, and EDR are mostly designed to detect events that have already happened, so they naturally miss pre-deployment staging. That makes pre-breach infrastructure analysis a governance problem as much as a detection problem, because defenders need visibility into upstream activity, not only confirmed compromise.

Key questions

Q: Why do SIEM and EDR miss preparation-phase attacks?

A: Because they are built around observable events, and preparation-phase infrastructure often exists before any malicious traffic, endpoint execution, or known-bad indicator appears. That makes them strong at reacting to campaigns in motion but weak at discovering the staging work that creates those campaigns. Teams need upstream infrastructure analysis, not just event correlation.

Q: How can security teams identify malicious infrastructure before an incident starts?

A: They should look for linked infrastructure patterns rather than isolated indicators. Domain registration timing, DNS changes, certificate issuance, hosting reuse, and WHOIS lineage can reveal staging clusters that look normal when viewed one asset at a time. The goal is to recognise campaign assembly before the first malicious event is visible.

Q: What breaks when threat intelligence only tracks indicators of compromise?

A: It breaks on timing. IOC-only workflows begin after an asset has already been used maliciously, so they miss dormant infrastructure, test environments, and prepositioned servers. The result is an intelligence process that documents what happened instead of helping teams interrupt what is being prepared now.

Q: How should SOC teams use pre-breach infrastructure data in operations?

A: They should treat verified staging signals as actionable intelligence for triage, blocklisting, and case enrichment. Pre-breach data is most useful when it feeds existing workflows early enough to stop campaign activation or widen scope during an investigation, rather than being archived as research only.

Technical breakdown

Why the preparation phase is invisible to event-driven tooling

Event-driven tools work by correlating something observable: endpoint activity, log entries, or known-bad indicators. Preparation-phase infrastructure does not yet produce those signals, so it can look identical to ordinary internet presence. Domains may be newly registered, servers may be provisioned without malicious traffic, and DNS may be configured long before any payload is delivered. That is why blocklists and standard correlation rules are structurally late rather than merely under-tuned. They depend on post-event evidence, while the adversary is still assembling the campaign scaffold. See the SIEM Guide.

Practical implication: Treat pre-breach infrastructure discovery as a distinct control domain, not a SIEM tuning exercise.

How adversary staging creates false normality

Preparation-phase infrastructure often blends into legitimate operations because the assets themselves are not yet weaponised. A registered domain, a certificate, or a server configuration is not inherently malicious, and attackers exploit that ambiguity. The article’s key point is that defenders need patterns, not isolated indicators, to identify staging. That is where behavioural clustering across DNS, WHOIS, certificate data, and host relationships becomes valuable, because the relationship between assets can reveal campaign preparation even when no single artifact is obviously hostile.

Practical implication: Build detection around infrastructure relationships and staging patterns, not just single indicators.

Why IOC-first workflows capture only the tail end of an attack

IOC-first workflows begin after weaponisation, when an asset has already been used in an incident or linked to known malicious activity. By then, the offensive lifecycle has advanced past preparation, and defenders are reacting to a campaign that is already in motion. This creates a timing mismatch: the data collection cycle starts with an incident, converts it into indicators, and then distributes those indicators after the attacker has had time to move on. The problem is not data quality alone. It is that the control is positioned downstream of the stage that matters most.

Practical implication: Shift hunting and enrichment upstream so staging can be interrupted before the first incident signal appears.

Threat narrative

Attacker objective: The attacker aims to launch a campaign from prebuilt infrastructure that is already operational, resilient, and difficult to disrupt once it becomes public.

1. Entry begins with quiet infrastructure staging, including domain registration, server provisioning, DNS configuration, certificate issuance, and test traffic that does not yet trigger alerts.
2. Escalation occurs when the staged assets are linked into a reusable campaign cluster and kept ready for deployment, often with fallback infrastructure already in reserve.
3. Impact follows once the campaign goes live, at which point defenders are responding to operational malicious infrastructure rather than intercepting the preparation work.

Breaches seen in the wild

• Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Preparation-phase blindness is a governance failure, not just a tooling gap. The article shows that security teams are often measuring the wrong moment in the attack lifecycle. If the first signal arrives only after infrastructure is weaponised, then the control model is already behind the adversary. Practitioners should treat pre-breach staging as an upstream risk domain that needs its own visibility and response logic.

Threat intelligence built around indicators of compromise is structurally reactive. IOC-based processes depend on malicious use having already occurred, which means they cannot discover dormant domains, test infrastructure, or prepositioned servers in time to stop the campaign. The meaningful shift is from indicator chasing to infrastructure pattern recognition, especially where DNS, certificate, and hosting relationships reveal adversary intent. That is where the field has to move next.

Infrastructure clustering is the named concept this article sharpens. The point is not merely that attackers use multiple assets, but that the relationship between those assets exposes preparation before a single indicator becomes public. Threat intelligence guide frameworks help, but practitioners need operational methods that pivot from one asset to an entire staging cluster. The practical conclusion is to hunt for relationships, not isolated artefacts.

The preparation phase changes the value of controls that are already in place. SIEM, EDR, and blocklists still matter, but they become containment and validation tools rather than primary discovery mechanisms. That distinction matters for governance, because teams must decide which controls are supposed to detect, which are supposed to enrich, and which are supposed to disrupt. The practitioner implication is to align tooling to lifecycle stage instead of expecting one stack to cover all stages.

For identity security teams, the lesson is that non-human infrastructure can exist before any non-human identity becomes visible. Even where the article is infrastructure-led rather than identity-led, the same governance issue appears in service accounts, certificates, and automation identities that are provisioned long before they are used. That makes inventory, ownership, and lifecycle visibility essential once infrastructure moves from staging to operation. The practitioner implication is to treat pre-production identity artefacts as part of the attack surface, not just the application estate.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Read next: Threat Intelligence Guide

What this signals

Preparation-phase visibility is a control plane problem. Teams that only watch for active compromise are managing the wrong layer of the lifecycle, because the infrastructure that enables the campaign is often already assembled before any alert exists. That shifts priority toward DNS, hosting, certificate, and registration analysis as operational inputs rather than background context.

Early detection changes containment economics. Silent Push says the average early-detection lead time reaches 104 days ahead of a traditional SIEM alert, and for Advanced Persistent Threat campaigns it has exceeded 300 days. That scale of lead time is only useful if organisations route it into hunting, scoping, and disruption workflows fast enough to matter.

For practitioners

• Map detection coverage to attack lifecycle stage Separate controls that discover staging infrastructure from controls that detect active compromise. If your stack only sees post-execution activity, it is operating too late for preparation-phase threats.
• Hunt for infrastructure relationships, not single indicators Correlate DNS history, WHOIS lineage, certificate data, and hosting links to find staging clusters that look normal in isolation but suspicious in combination.
• Feed pre-breach signals into existing response workflows Push verified staging infrastructure into blocklists, case management, and SOC triage so analysts can act before a campaign becomes operational.
• Expand incident scoping beyond the first observed indicator When a campaign is found, pivot from the triggering domain or IP to fallback infrastructure, related registrations, and adjacent hosting patterns so remediation does not stop at the visible tip of the cluster.

Key takeaways

• The core risk is not missed malware, but missed preparation, because adversaries can build and test infrastructure long before conventional tools produce a signal.
• Silent Push describes an average 104-day lead over a traditional SIEM alert, with APT campaigns exceeding 300 days, which shows how far behind event-driven detection can be.
• Defenders need lifecycle-aware controls that identify staging clusters, enrich investigations, and block infrastructure before it becomes a live campaign.

Related NHI Mgmt Group resources: Threat Hunting Guide · Threat Intelligence Guide · SIEM Guide · SOAR and Security Automation Guide

Key terms

• Preparation Phase: The preparation phase is the period before an attack becomes operational, when adversaries build the infrastructure they intend to use. It can include domain registration, server provisioning, DNS setup, and testing. The danger is that this work often looks normal until the campaign is already live.
• Indicator Of Future Attack: An indicator of future attack is infrastructure, behaviour, or content that suggests an adversary is preparing a campaign before compromise is visible. It shifts detection from after the breach to before execution, which is critical for preemptive defense and AI-assisted triage.
• Infrastructure Clustering: Infrastructure clustering is the process of linking related domains, hosts, certificates, and DNS changes to reveal a common adversary staging effort. It helps analysts move beyond isolated indicators and identify campaign assembly before a single asset is used maliciously.
• Event-Driven Detection: A monitoring approach that reacts to cloud control-plane events as they happen instead of waiting for a scheduled scan. It is better suited to ephemeral infrastructure because it preserves timing, supports rapid response, and reduces the chance that short-lived exposures go unseen.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity lifecycle controls to the broader security programmes they support.