Time on Target

How Time on Target Works

Time on Target is a co-ordinated pattern rather than a single technique. The key idea is synchronisation, with separate actions arranged so their effects land together and create a spike in load, alert volume, or processing demand. In cyber operations, that timing can turn otherwise manageable activity into a burst that is harder to absorb.

This makes the concept useful whenever defenders need to think about concurrency, burstiness, and control saturation. The same pattern can appear in intrusion attempts, denial-of-service activity, noisy brute-force events, or tightly choreographed changes that seek to slip through windows between checks.

Why Coordinated Timing Is Dangerous

Coordinated timing is dangerous because many defensive layers are tuned for average load, not sudden alignment. Logging, rate limits, queueing systems, analyst workflows, and automated response can all be stressed when events arrive in sync instead of spread out.

The risk is not only volume. If multiple actions occur at once, they can hide causal relationships, complicate attribution, and create short-lived gaps where telemetry is incomplete or response arrives too late. That is why defenders often study timing as part of attack choreography, not just payload content.

A useful way to think about the pattern is that the attacker is trying to force the environment to fail as a system, not as isolated hosts. MITRE ATT&CK Enterprise Matrix helps map the broader adversary behaviours that often accompany coordinated activity, while ENISA Threat Landscape is useful for understanding how bursty, multi-vector operations fit into current threat patterns.

Where Defenders Should Look for It

Exposure often shows up in places where many events can be launched together: distributed accounts, parallel sessions, API calls, scheduled jobs, or chained automation. The more the environment relies on shared thresholds, shared queues, or shared responders, the more attractive synchronised action becomes.

Detection should focus on correlated spikes across systems, not just a single alert source. When a burst spans authentication, network, application, or cloud control planes, the pattern may only be visible if telemetry is centralised and time-synchronised well enough to reconstruct the sequence.

NIST Cybersecurity Framework 2.0 supports this kind of cross-cutting visibility by emphasising identify, detect, respond, and recover capabilities, and NIST SP 800-53 Rev 5 Security and Privacy Controls gives practitioners a control vocabulary for audit, monitoring, and response discipline.

How to Reduce the Effect of Synchronised Activity

Reducing impact usually means making timing less exploitable and making bursts easier to absorb. That includes resilient queue design, tuned thresholds, staggered processing where possible, and response playbooks that assume multiple related events may arrive together.

Controls that limit blast radius matter because Time on Target often succeeds by compressing many actions into one window. Strong segmentation, least privilege, and robust logging do not stop the timing pattern by themselves, but they make it harder for a coordinated burst to produce systemic failure or hide follow-on activity.

Practitioner Guidance

What to watch for: Look for repeated correlations in time, source diversity, and target selection, especially where separate events appear unrelated until they are plotted together. A single alert may look routine, but aligned bursts across channels often indicate orchestration rather than coincidence.

Governance implication: Teams should treat timing as an operational signal in the same way they treat volume and severity. If monitoring, response, or change control assumes isolated events, update the operating model to account for synchronised activity and the possibility of deliberately engineered overload.

Related resources from NHI Mgmt Group

• Why do Android banking trojans often target SMS, overlays, and keylogging at the same time?
• Why do banks face such high impact when attackers target accounts, payment rails, and customer data at the same time?
• What attacks target PTP (Precision Time Protocol)?
• What attacks target real-time operating systems?