Black Owls Network Communications

The password was correct. The login was approved. It was 7 p.m. on a Friday. Nobody was watching.

That is close to how one of the incidents in the 2026 Comcast Business Cybersecurity Threat Report began. An attacker signed in to a company’s remote access with stolen credentials on a Friday evening, then spent the night moving quietly from system to system, collecting more passwords. The pattern pointed to ransomware timed for the weekend, when fewer people are around to respond. It was contained that same night — not because a lock held, but because someone was watching the behavior and shut it down before Monday.

Attackers don’t break in. They log in.

Attackers rarely break the door anymore. Increasingly they just log in. A password stolen through a fake login page, or bought online, opens remote access, email, and cloud apps the same way it does for your employee. Comcast’s own framing puts it plainly: identity is the connective tissue across modern attacks, from the first entry to the final theft of data. Once someone is inside with valid credentials, they look like ordinary traffic. Nothing is broken, so nothing sounds an alarm.

This is not a niche problem. Comcast Business analyzed 79.3 billion security events in a single year, from March 2025 to February 2026, and recorded 25.4 billion phishing events — the low-effort, wide-net attacks whose entire purpose is to trick someone into handing over a password. Separately, Rapid7 found that valid accounts with missing or weak multi-factor authentication were the way in for 43.9% of the incidents it investigated in 2025. A stolen password doesn’t set off an alarm. It looks like your best employee working late.

And a password is not the only key worth stealing: attackers increasingly hijack live sessions and browser tokens, which can carry them past a login that already passed MFA. Comcast logged 47.9 billion initial-access events and millions of attempts to hijack browsers in the same window. This is industrial-scale, automated pressure, made cheaper and more convincing by AI — not a handful of targeted hackers.

But doesn’t MFA solve this?

Multi-factor authentication — the second sign-in step — is the single most useful control here, and you should have it everywhere. But it is a speed bump, not a wall. The Comcast report documents attackers bypassing MFA outright, in one case through device-code phishing, tricking a user into approving access on the attacker’s behalf. The login succeeded and data theft was already in progress. What stopped it was not the lock. It was detection: the behavior looked wrong, and someone caught it mid-exfiltration.

That is the uncomfortable shift the report keeps returning to. AI has collapsed the time between a vulnerability appearing and an attacker using it, and no one patches every system or blocks every intrusion in time. What separates a contained event from a front-page one is the ability to notice what slipped through and shut it down fast. The report’s own conclusion is blunt: prevention still matters, but resilience — the ability to detect, contain, and recover quickly — is now what decides how bad an incident becomes.

So the real question isn’t how good your locks are

It is who notices when the right key is in the wrong hands — at 2 a.m. on a Sunday, when the login looks perfectly normal.

That is a different kind of investment than most businesses have made. Strong passwords, MFA, and a firewall are the locks, and they matter. But they assume the attacker is on the outside. The weekend-ransomware playbook assumes the attacker is already inside, holding a valid key, moving slowly enough to look ordinary. Catching that takes continuous visibility into behavior, and someone — or something — watching for it with the authority to cut off an account before anyone calls to confirm.

For most businesses, this does not mean building a 24/7 security operations center. It means making sure someone is actually watching: a managed detection service or your IT partner, watching behavior rather than just block lists, with standing permission to kill a suspicious session at 2 a.m. without waiting for a callback. The weekend attacker is counting on the gap between “something looks wrong” and “someone with the authority acted.” Close that gap and the stolen key stops being enough.

Most companies lock their doors well. Far fewer check who is walking in with a key.

Pressure-testing exactly this — how remote access is protected, who is watching it, and who can act when something looks wrong — is the kind of review we do as an independent advisor. See how we approach cybersecurity, or if you want the short list I use to check it, get in touch.

Sources