The Alert Fired at 2:14am. You Heard at 9:30. What Happened in Between?
Between the alert firing and your phone ringing sit four unregulated steps: triage, severity scoring, escalation and a notification decision. Every published breach deadline starts when a human discovers or determines something, so those hours sit outside every clock. Federal agencies must report inside one hour. Your call has no deadline at all.
- Four steps sit between an alert and a phone call. Triage, severity scoring, escalation to someone with authority, and the decision to tell you. Your contract probably times none of them.
- Every published breach-reporting deadline starts at a human event. Discovered, became aware, determined, identified. The hours before that moment sit outside every clock in the system.
- Three provider-to-customer clocks exist and none is fast. 72 hours under SEC rules, thirty days under New York law, 60 calendar days for a HIPAA business associate.
- Federal agencies must report an incident to CISA within one hour of their own security team identifying it. No rule sets anything equivalent for the call to you.
- Four lines close the gap. Who is woken, at what severity, who may act without asking, and the longest you may go uncalled regardless.
What happens between the alert firing and someone phoning you?
Four steps sit between the alert firing and your phone ringing. Someone triages the alert, classifies its severity, escalates it to a person with authority, then decides whether to notify you. No published rule puts a clock on the first three, and every clock on the fourth starts only once a human already knows. Most agreements describe the tooling instead of the chain of hands, which is why nobody has ever told you what occupied those seven hours.
The hours in question are the hours attackers choose. Sophos reviewed 661 incident response cases handled between November 2024 and October 2025 and found 88 percent of ransomware payloads were deployed during non-business hours, with 79 percent of data exfiltration also taking place off-hours. It measured 3.4 hours from an attacker getting inside to reaching the Active Directory server. A chain of hands that takes seven hours to produce a telephone call is not slow by accident. It is untimed.
This guide walks the published stages, names every reporting deadline that does exist and the exact event each one starts from, then gives you four lines to put in the agreement. Read it beside 24/7 Monitoring Means Four Different Things, which covers who is allowed to act, and How to Test Your MSP's Escalation Path, which covers who answers the phone. This post covers the gap before anybody picks one up.
The published stages of handling an incident, and the one with no clock
Published guidance names the stages and hands their timing back to you. The UK National Cyber Security Centre names four core response stages of analyse, contain, remediate and recover, and says the severity level will inform how quickly the incident needs to be handled and who it might need to be escalated to. It then tells you to document how quickly the escalation needs to occur. Each stage produces something you can ask to see. A severity rating, a containment decision, a notification, then an after-action record. The standard asks the question. You supply the number, inside your own incident response plan.
NIST supplies the vocabulary rather than the schedule. Its glossary defines an event as any observable occurrence involving computing assets, citing Special Publication 800-61 Revision 3, and an incident as an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system. Your 02:14 alert is an event. A human has to promote it to an incident, and that promotion is a judgment call with no deadline attached to it.
The current NIST incident response publication is SP 800-61 Revision 3, published in April 2025 as a CSF 2.0 Community Profile, which frames incident response as part of cybersecurity risk management rather than as a standalone procedure. Its body is a PDF, so we worked from the publication record and the abstract, which states the aim of improving the efficiency and effectiveness of incident detection, response, and recovery activities. Efficiency is named there. Hours are not.
CISA says the quiet part out loud in its performance goals. Goal 5.B asks an organization to hold procedures on whom to report incidents to, to follow the timeframes in applicable regulatory guidance, and otherwise to report as soon as safely feasible. That is the national cyber defense agency confirming that absent a regulation, no number exists. Its supply-chain goal is blunter still. It asks that contracts and service-level agreements require a vendor or service provider to notify the procuring customer of security incidents within a risk-informed time frame as determined by the organization. Read that last clause again. CISA is telling you the number is yours to set, which is the clearest possible confirmation that nobody has set it for you. It leaves the interval between your alert and your phone call unregulated by anything except the agreement you signed.
Why your 2:14am alert is not an incident yet
An alert becomes an incident when a human decides it is one, and that decision is the slowest link in the chain. The reason is noise. The SANS 2025 Detection and Response Report found 73 percent of respondents cite false positives as their top detection challenge and that 60 percent of organizations encounter false positives frequently or very frequently, with 20 percent reporting very high rates against 13 percent the year before. A staffed overnight desk still has to work through that.
Waking a client for a false alarm costs a provider more than waiting does, so waiting becomes the default. Google's site reliability engineering handbook publishes three tests for declaring an incident, and the third asks whether the issue is unsolved even after an hour's concentrated analysis. That is a published one-hour threshold, and it governs the moment engineers admit they have an incident rather than the moment a customer hears about it.
Severity is defined, and it is not defined for you. CISA scores a federal incident on eight attributes, including functional impact, information impact and recoverability, then assigns one of seven levels running from Emergency (black) down to Baseline Negligible (white). That schema measures harm to national interests. It says nothing about whether your payroll run completes on Friday. NIST's glossary defines both event and incident and carries no entry for triage at all, so the severity scale that decides whether you get woken is usually your provider's own, written down nowhere.
Every breach deadline starts after somebody already knows
Every published breach notification deadline starts from a human event rather than a machine one. The words the rules use are discovered, became aware, determined and identified. The hours your tools spent noticing sit before the start line of every clock in the system. Seven deadlines are listed below with the trigger each one counts from, because a bare 72 hours is the exact ambiguity that lets a provider sound compliant and tell you nothing.
- Federal agencies report to CISA within one hour, counted from the incident being identified by the agency's top-level Computer Security Incident Response Team.
- HIPAA business associates notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery of a breach.
- Service providers to SEC-covered institutions notify the firm as soon as possible and no later than 72 hours after becoming aware of a breach involving a customer information system the provider maintains.
- SEC-covered institutions notify affected individuals as soon as practicable, but not later than 30 days, after becoming aware of unauthorized access to customer information.
- New York DFS covered entities notify the superintendent no later than 72 hours after determining that a cybersecurity incident has occurred, including an incident at a third-party service provider.
- Financial institutions under the FTC Safeguards Rule notify the FTC no later than 30 days after discovery where at least 500 consumers are involved.
- Any business holding data it does not own, under New York law, notifies the owner or licensee immediately, provided that such notification shall be made within thirty days following discovery.
Three of those seven are provider-to-customer clocks, and the comparison between them is the whole argument. A HIPAA business associate gets 60 calendar days to tell the covered entity. A service provider to an SEC-covered institution gets 72 hours from becoming aware, and that rule reaches only broker-dealers, investment companies, registered investment advisers and transfer agents. New York gives any business holding private information it does not own thirty days following discovery to tell the owner. All three start once the provider already knows, and none of them times the hours before that.
One rule does push on the hours before awareness, and it is the single best thing to ask for by name. HIPAA treats a breach as discovered on the first day it is known, or by exercising reasonable diligence would have been known, to the business associate. Reasonable diligence sets no hours. It does stop a provider arguing that the clock never started because nobody happened to look. That constructive-knowledge test is the closest thing in United States rules to a duty on the gap between the alert and the answer, and nothing in it helps a business outside health care.
What actually stalls the chain at 02:14
Authority stalls it. An analyst who may not isolate a machine can only try to reach somebody who can, so the escalation path parks at the step where a person has to say yes. The NCSC puts it plainly, advising that the people escalated to must have the authority to make critical decisions and that key contacts should carry at least two contact methods and two or more people, with deputies named for each.
Allied government guidance already expects this to be contractual. CISA, the NSA, the FBI and international partners advise that contracts should detail how and when MSPs notify the customer of an incident affecting the customer's environment, and that a customer require notification of confirmed or suspected security events and incidents occurring on the provider's infrastructure, sent to a security operations center for analysis and triage. Notification timing appears in that advisory as a contract term, which tells you exactly where the obligation lives. It lives wherever you put it.
The delay is not neutral, because evidence expires while the chain waits. Sophos found cases hampered by missing logs doubled year over year, driven by firewall appliances whose default retention was only seven days and in some cases 24 hours. By the time a Monday technician opens the queue, the record of what happened at 02:14 can already be gone. Our guide to log retention and dwell time covers that side, and detection coverage covers whether the alert fires at all.
Nearly half the time, the first notice comes from outside the business. Mandiant, drawing on over 500,000 hours of frontline investigations in 2025, found organizations first detected evidence of malicious activity internally 52 percent of the time, up from 43 percent, and put global median dwell time at 14 days, up from 11. Sophos, measuring its own response caseload, reported median dwell time down to three days. IBM measured an average 247 days to identify and contain an active breach against a global average breach cost of 4.99 million dollars. Your seven silent hours sit at the front of all of those numbers.
A provider who can tell you when the alert fired, when a human read it, and when you were called is operating a chain. A provider who can only tell you the product name is operating a tool.
Four lines to put in the agreement
Four lines close the gap, and each one is a sentence a provider can accept or decline in writing. Put them in the agreement rather than the proposal, because a proposal states an intention and an agreement creates an obligation. Each line turns incident notification from a courtesy into a measurable term.
- Name the severity levels and say which ones wake you, so the scale is written down and is yours rather than inherited from a dashboard.
- Set a maximum time to first human contact at each severity level, measured in minutes from the detection timestamp, and put it in the service level agreement rather than the sales deck.
- List the containment actions the provider may authorize alone, such as isolating a host, disabling an account or blocking a domain, and name the ones that need you first.
- Fix a call-regardless deadline, so you are telephoned after an agreed interval even when the alert is still unresolved and even when it later turns out to be nothing.
Then ask for one number every month. The count of alerts triaged outside business hours, with the detection timestamp printed beside the notification timestamp. CISA's own federal reporting form requires an agency to identify when the activity was first detected, so a detection timestamp is an ordinary thing for a report to carry rather than an awkward request. A provider that cannot produce one is not measuring the gap you pay it to close.
How to test the chain this week
To test the chain, send two requests and make one call. Each takes a well-run provider a single sentence to answer, and each is awkward for a provider that has never thought about the question.
- Request the written severity matrix, and check which level triggers a telephone call rather than a ticket.
- Request last quarter's out-of-hours alert count, with the longest gap recorded between detection and customer contact.
- Call the after-hours support number at 10pm on a Saturday and time how long it takes to reach a person who can name your environment.
Judge what comes back on numbers rather than adjectives, and verify each answer against a timestamp rather than a recollection. Good sounds like five named severity levels, a 30-minute contact target on the top two, and a longest gap of 51 minutes last quarter. Weak sounds like we would call you straight away. None of this buys perfect security, and no honest provider claims that it does. It buys a measurable, contractual answer to one question most agreements leave blank. Best IT MSP is independent and does not sell IT services, so we rank providers on verified rating and firmographic data and publish our evaluation method in full.
FAQ
How long does my MSP have to notify me of a security incident?
No single rule covers every business, and three regimes set a deadline. A HIPAA business associate must tell the covered entity no later than 60 calendar days after discovery, a service provider to an SEC-covered institution must report within 72 hours of becoming aware, and New York allows thirty days following discovery. Outside those, the deadline is whatever your contract says.
What does the 72-hour breach notification rule start from?
It depends which 72 hours you mean. New York DFS counts 72 hours from determining that a cybersecurity incident has occurred. The SEC counts 72 hours from a service provider becoming aware of a breach. Neither counts from the moment a monitoring tool fired, so both can begin hours after the event itself.
What is alert triage, and why does it take so long at night?
Alert triage is the step where an analyst decides whether an alert is real and how serious it is. It takes time because most alerts are not real. SANS found 73 percent of respondents cite false positives as their top detection challenge and 60 percent meet them frequently or very frequently. Ask your provider how long triage takes overnight.
Should my MSP wake me at 2am?
Yes, at severity levels you agreed in advance, and the agreement is the part that matters. Sophos found 88 percent of ransomware payloads were deployed during non-business hours. Decide now which levels earn a telephone call, which earn a ticket, and the longest you may go uncalled while an alert is still open.
Who decides whether an alert is an incident?
Your provider's analyst does, using a severity scale that is usually unpublished. CISA runs seven federal severity levels from Emergency (black) to Baseline Negligible (white), scored on attributes such as functional impact and recoverability. Ask to see the scale your provider uses and which level triggers a call to you.
Best IT MSP is the independent directory of managed IT and cybersecurity providers across the US and Canada. We rank on verified rating and firmographic data, we label paid placement, and we do not sell IT services. Ask three merit-ranked providers in your city for their severity matrix and their longest detection-to-call gap, then compare what comes back.