💡 WHY MORGAN IS RIGHT
Attackers pick the hours when nobody is watching, and the first signs are small: a spike of failed logins, a new admin token, an export from an unusual country. Waiting until morning gives an intruder six free hours with the data. High-confidence security detections deserve a page even when no customer is affected yet, because by the time customers notice, the damage is done and the incident comes with a breach notification.
