Attackers Don't Take Holidays, But They Know You Do

Halcyon ROC observed that attackers deliberately concentrate activity in the hours before long holiday weekends to exploit reduced SOC/IT coverage—illustrated by a nearly threefold single-day alert spike on April 2—and recommends continuous, holiday-agnostic monitoring to reduce detection and response gaps.