If you look at the timing of ransomware attacks against SMBs over the past few years, the pattern is hard to miss. Friday evenings. Long weekends. The week between Christmas and New Year’s. The Monday morning of a holiday weekend, when nobody walks in until Tuesday.
This isn’t a coincidence. Attackers pick these windows deliberately. And most SMBs are organized in ways that make those windows wide open.
Why the timing works for attackers
The math is straightforward. An attack that lands at 9 a.m. Tuesday has someone watching within minutes. The IT team is at their desks. The MSP is responsive. Alerts get triaged quickly.
The same attack at 11 p.m. Saturday gets a different response. The alert goes to a queue. The on-call rotation, if there is one, may not have the authority to make containment decisions. The decision-maker is at a family dinner with their phone on silent.
By the time anyone notices, the attacker has had eight, twelve, sometimes twenty hours of free movement inside the environment. That’s enough time to find sensitive data, exfiltrate it, and trigger encryption across the network. The Monday morning return-to-work becomes the Monday morning crisis.
Holidays amplify this. A Thanksgiving weekend in the US, the December holiday period across Western markets — all of these create windows where SMB security coverage thins out for days at a time. Attackers know this. They plan around it.
The structural gap in most SMBs
Three things create the vulnerability.
First, monitoring without response. A lot of SMBs have detection tools running 24/7. The tools produce alerts at all hours. But the people who can act on those alerts are not on duty. The alert sits, accumulating priority, until someone arrives in the morning.
Second, ambiguous authority. When an alert does get to a human after hours, that human often doesn’t have the authority to take containment action. Isolating a critical server. Disabling a privileged account. Cutting off network access to a segment of the environment. These require decisions that the on-call IT contractor may not feel empowered to make at 2 a.m. without checking with leadership.
Third, communication delays. The chain of escalation breaks down outside business hours. The IT person calls the manager who doesn’t answer. The manager finally calls the CEO who’s traveling. Hours pass before anyone with authority is in the loop. Attackers don’t wait for the chain to reconnect.
What changes when the gap closes
The SMBs that have addressed this gap operate differently during incidents. The detection still happens, but so does the response. Containment actions get taken within minutes of a confirmed threat. The escalation chain is clear, pre-authorized, and tested.
The most common way SMBs close this gap is through managed detection and response. The model shifts the burden of off-hours coverage from the SMB’s own team to a provider whose entire business is being available when the SMB’s team isn’t.
This isn’t about replacing internal IT. It’s about providing the layer of coverage that internal IT can’t realistically deliver. Even a strong internal team can’t be at full attention 168 hours a week. A serious MDR service engagement provides that coverage with people whose job, at any given hour, is to be watching.
What good off-hours response looks like
Real response authority. The provider can isolate, contain, and neutralize without waiting for the SMB’s approval on every step. Pre-authorized playbooks define what can be done unilaterally and what requires escalation.
Clear escalation criteria. Not every alert needs to wake up the CEO. The provider knows what to handle internally, what to flag to the IT lead, and what to escalate to executive leadership.
Documented timing. After every off-hours incident, there should be a record. What triggered, when. What was detected, when. What was contained, when. The timeline tells you whether the program is actually working at the speed it claims.
Integration with your team. The provider doesn’t operate in a silo. They know your environment, your people, and your business context. When they take action, they understand the consequences. When they escalate, they reach the right person.
The holiday-specific risk
Beyond the regular weekend pattern, holidays create concentrated risk. Industry data has shown ransomware activity spiking during periods when defenders are predictably away. The Fourth of July in the US. The week between Christmas and the New Year almost everywhere.
For SMBs without 24/7 coverage, these periods deserve specific planning. Reduced staffing means reduced response capability. Knowing this in advance, you can pre-position resources, brief on-call staff with extra clarity, and tighten the criteria for what gets escalated.
What to do if this describes your environment
Start with an honest assessment of your off-hours coverage. Not “we have monitoring.” Specifically: if a ransomware encryption pattern starts at 11 p.m. on a Saturday, what happens in the next 60 minutes?
If the answer involves multiple unanswered phone calls and uncertainty about who can authorize what, you have the gap.
The bottom line
Attackers will keep targeting the windows when defenders aren’t watching. That pattern isn’t going to change. What can change is whether your environment is one of the easy targets or one of the hard ones.
Defensible runs MDR with analyst-led threat hunting and real response authority, designed for the windows when the rest of the team is offline. Talk to an expert.
