The 181-day problem: why breaches go unnoticed

IBM's Cost of a Data Breach Report 2025 puts the global average time to identify a breach at 181 days. That's about six months in which an attacker can be inside a network without anyone noticing. Where does all that time go?

Attackers are built to be quiet

Most attackers don't break things on day one. They log in with stolen or guessed credentials, look around, and move carefully from one system to the next. To most monitoring tools, a valid login looks like a normal day at work.

Perimeter tools watch the door, not the house

Firewalls, VPN gateways and email filters are designed to stop attacks at the edge, and they stop a lot. But once someone is inside with working credentials, those tools often have nothing left to say. The attacker is no longer at the door.

Too many alerts, too few people

Where a company does collect logs, the volume is the problem. A small team can't investigate every unusual event, so real warning signs sit in the same queue as harmless noise. Breaches are often found in the end by someone outside the company: a customer, a partner, or the attacker's ransom note.

What shrinks the number

• Detection inside the network, not just at the edge. Something has to notice what happens after the attacker gets in.
• Signals that don't need triage. An alert you can trust gets acted on in minutes, not added to a queue.
• A clear owner. Someone needs to know that an alert is theirs to act on, at any hour.

Decoys meet the first two directly: they sit inside the network, and a touch on one is a confirmed signal. That is how detection time drops from months to seconds.

Why it matters more in India now

CERT-In's 6-hour clock runs from when you notice an incident. The DPDP Act adds breach notification to the Board and to affected people, enforced from 13 May 2027. Noticing late doesn't avoid those duties. It just means meeting them with six months of damage to explain.