Failures, incidents and official sources
\"24/7\" security monitoring: overnight gaps, holiday shutdowns and alert fatigue
How to test whether a managed security service really watches and acts around the clock, why alert fatigue causes missed attacks, and the questions and drills that expose gaps.
A service sold as "24/7 monitoring" may mean anything from analysts on shift every hour who can isolate a device within minutes, to an automated platform that runs all night while people review the queue in the morning. The difference matters because attackers often act outside business hours: late on Friday, over long weekends and during the Christmas–New Year shutdown many Australian businesses take. The way to find out what you are buying is to ask specific questions about overnight staffing and authority, and then test it with an agreed drill. Alert fatigue is the second risk: if a provider or your team sees thousands of low-value alerts, the important one gets missed.
This guide belongs to the failures pillar. For pricing of round-the-clock services, see MDR and SOC pricing.
What "24/7" can mean
| Model | What happens at 2 am | Typical use |
|---|---|---|
| Analysts on shift, with containment authority | A person triages and isolates the device or disables the account | True MDR |
| Analysts on shift, notify only | A person triages and phones or emails you; you decide | Co-managed SOC |
| Automated containment overnight, humans in the day | Rules block known-bad activity; anything else waits | Lower-cost tiers |
| On-call engineer paged for critical alerts | One person woken for P1 only | Smaller providers |
| Platform runs 24/7, people work business hours | Nothing human until morning | Managed endpoint marketed loosely |
Each can be appropriate at the right price. The problem is when the buyer thinks they have the first and actually have the fourth or fifth.
Questions that reveal real coverage
- How many analysts are on shift between midnight and 6 am Australian Eastern time, and how many clients do they cover?
- In which country are they?
- What can they do without contacting us? Show me the containment rules.
- How do you contact us for a P1 at 3 am, and what happens if nobody answers in 15 minutes?
- What are your response targets on public holidays, including the days between Christmas and New Year?
- Can you show me your response times for P1 alerts over the last quarter, across all clients?
Ask for answers in writing and attach them to the contract.
Test it: an agreed drill
With the provider's agreement, run a drill outside business hours: for example, run a harmless test file that the EDR platform is designed to flag (many vendors supply one) on a test device on a Saturday night, and record:
| Measure | Target from the contract | Result |
|---|---|---|
| Time from detection to analyst triage | e.g. 15 minutes | |
| Time to notify your on-call contact | e.g. 30 minutes | |
| Containment action taken | e.g. device isolated | |
| Quality of the notification | Clear, actionable |
Agree the drill in writing first so it is not treated as a real attack and so nobody wastes effort. If the provider refuses to be tested, that is information too.
Alert fatigue: why attacks get missed
Security tools generate many alerts, most of them harmless. An illustrative month for a 50-person business:
| Stage | Count |
|---|---|
| Raw alerts from endpoint, email and identity tools | 2,000 |
| Closed automatically by rules | 1,900 (95%) |
| Triaged by an analyst | 100 |
| Escalated to the business | 10 |
| Real incidents needing action | 1 |
If your own team receives all 2,000, or even the 100, the one that matters is easily lost. A good service tunes rules so escalations are few and meaningful. A poor one either escalates everything (pushing the work back to you) or closes too much automatically.
Ask the provider how it tunes alerts, how it measures false positives, and how often it reviews automatic closing rules. Look at the monthly report: if escalations are steadily rising with no explanation, or are always zero, ask why.
Holiday and weekend planning
- Know your shutdown dates. Tell the provider when the office is closed and who is on call.
- Keep an on-call roster. At least two people who can approve actions, with phone numbers the provider has.
- Raise sensitivity before long weekends. Some providers can tighten automatic containment during closure periods.
- Check payment approvals. Payment-redirection fraud often relies on staff being away. Keep call-back verification active during holidays.
Frequently asked questions
Is offshore overnight monitoring a problem?
Not in itself, and it is how many providers achieve 24/7 coverage. Know where data goes, and check your Privacy Act obligations about overseas disclosure.
Our provider escalates almost nothing. Is that good?
It may be well tuned, or it may be closing too much. Ask to see a sample of alerts closed automatically, and run a drill.
Can a small business afford true 24/7 MDR?
Per-user MDR pricing has made it more accessible. Use the cost estimator to compare a 24/7 bundle against business-hours cover.
What if the provider misses the drill?
Discuss it, ask for a corrective plan and repeat the test. Repeated misses against contract targets may give you termination rights.
Sources
- ASD's Australian Cyber Security Centre — guidance on detection, event logging and incident response
- Scamwatch — payment redirection and business email compromise
- business.gov.au — cyber security resources for small business
