Topic starter
24/10/2026 9:48 pm
TL;DR: Campaigns can spend weeks or months in preparation before any alert fires, according to Silent Push. Detection programs need to surface staging clusters and related infrastructure before event-driven tools see malicious activity.
Editorial analysis by NHI Mgmt Group, based on content published by Silent Push: “What Is the Preparation Phase? The Part of the Attack Timeline Most Tools Miss”.
By the numbers:
- The average early-detection lead time from that process is 104 days ahead of a traditional SIEM alert.
- For Advanced Persistent Threat campaigns, the lead time has exceeded 300 days.
Key questions
Q: How can security teams identify malicious infrastructure before an incident starts?
A: They should look for linked infrastructure patterns rather than isolated indicators.
Q: What breaks when threat intelligence only tracks indicators of compromise?
A: It breaks on timing. IOC-only workflows begin after an asset has already been used maliciously, so they miss dormant infrastructure, test environments, and prepositioned servers. The result is an intelligence process that documents what happened instead of helping teams interrupt what is being prepared now.
Q: Why do SIEM and EDR miss preparation-phase attacks?
A: Because they are built around observable events, and preparation-phase infrastructure often exists before any malicious traffic, endpoint execution, or known-bad indicator appears.
Practitioner guidance
- Map detection coverage to attack lifecycle stage Separate controls that discover staging infrastructure from controls that detect active compromise.
- Hunt for infrastructure relationships, not single indicators Correlate DNS history, WHOIS lineage, certificate data, and hosting links to find staging clusters that look normal in isolation but suspicious in combination.
- Feed pre-breach signals into existing response workflows Push verified staging infrastructure into blocklists, case management, and SOC triage so analysts can act before a campaign becomes operational.
Bottom line: The core risk is not missed malware, but missed preparation, because adversaries can build and test infrastructure long before conventional tools produce a signal.
Glossary terms: Preparation Phase, Indicator Of Future Attack, Infrastructure Clustering, Event-Driven Detection
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:13 am
Preparation-phase blindness is a governance failure, not just a tooling gap. The article shows that security teams are often measuring the wrong moment in the attack lifecycle. If the first signal arrives only after infrastructure is weaponised, then the control model is already behind the adversary. Practitioners should treat pre-breach staging as an upstream risk domain that needs its own visibility and response logic.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should SOC teams use pre-breach infrastructure data in operations?
A: They should treat verified staging signals as actionable intelligence for triage, blocklisting, and case enrichment. Pre-breach data is most useful when it feeds existing workflows early enough to stop campaign activation or widen scope during an investigation, rather than being archived as research only.
👉 Read our full editorial: The preparation phase leaves most threat tooling looking too late
This post was modified 6 days ago by NHI Mgmt Group