The Pentagon data breach tied to dwell time showed a clear 2026 lesson for Nigeria: unauthorized users remained inside a Defense Manpower Data Center system operated by the US Department of Defense for nearly twelve months before discovery, giving them time to expose more than three million records, including Social Security numbers, birth dates, contact information, and sensitive military job data. The breach was not the result of a failure to deploy security products. The failure was the absence of continuous monitoring that would have detected unauthorized access behavior while it was happening, rather than long after the damage was done. This gap the time between when attackers enter an environment and when that entry is detected is called dwell time. And it is not a problem unique to the US Department of Defense.
For Nigerian financial institutions, telecommunications companies, and large enterprises, especially those with compliance obligations and limited in-house specialist security teams, the risk is immediate. These organizations operate complex environments with extensive data holdings, regulatory requirements, and expanding digital attack surfaces, yet far fewer have 24/7 Security Operations Center coverage that monitors for attacker behavior after perimeter controls have been bypassed. That is where long dwell time becomes expensive: attackers can extract sensitive data over months, create regulatory exposure under frameworks such as the Central Bank of Nigeria's cybersecurity requirements, and inflict reputational and financial damage before anyone responds. The Pentagon breach illustrates precisely what happens in the absence of that monitoring layer. This article examines dwell time, why behavioral detection and continuous SOC monitoring matter, the specific challenges Nigerian organizations face, and how SHELT Global's managed security services help reduce attacker dwell time before a breach turns into a prolonged compromise.
The Defense Manpower Data Center breach involved unauthorized access to a system holding personnel records for active duty military, veterans, and Department of Defense civilian employees, with unauthorized users accessing files from October 2025 to July 2026 through FBIJobs.gov. During that period, the attackers had read access to sensitive personal information for over three million individuals, including Social Security numbers that enable identity fraud, birth dates used for account verification, contact details that enable targeted phishing and social engineering, and military occupational data that can inform counterintelligence targeting. Hackers linked to ShinyHunters claimed to have stolen 2-3 terabytes of data.
The twelve-month dwell time is not an outlier. Industry data consistently shows that the median time between an attacker gaining access and an organization discovering the breach exceeds 150 days. For organizations without dedicated SOC monitoring, that number is significantly higher. In many cases, breaches are discovered not through the organization's own detection capabilities but through external notification of a third party, law enforcement, or the attackers themselves when they begin demanding ransom.
For Nigerian organizations, the relevance is direct. The Central Bank of Nigeria's cybersecurity framework for financial institutions requires that banks maintain continuous monitoring capabilities and report material cybersecurity incidents within defined timeframes. An organization that discovers a breach twelve months after it began cannot meet those reporting obligations, and longer dwell times can also increase exposure under the Nigeria Data Protection Act by compounding compliance penalties and reputational damage. It also cannot limit the damage to the period before discovery by the time the breach is found, the attacker has had nearly a year to extract data, establish persistence, and potentially monetize access. That same delay could determine the severity of any breach involving Nigerian infrastructure tied to Pentagon-related workflows or data.
Nigerian banks, fintechs, and telecommunications companies are operating in an environment where Nigerian financial institutions and government agencies or databases face constant attacks from cybercriminal actors. Nigerian organisations are experiencing over 4,700 cyberattacks every week. The growth of mobile banking infrastructure, digital payment platforms, and cloud-hosted financial services has created a larger and more valuable attack surface with millions of users and more potential threats to monitor. A new report found that 40% of Africans reported being cybercrime victims in 2025, and cybercrime costs African countries $3 billion annually in lost business across West Africa. At the same time, the sophistication of threats targeting West African financial institutions has increased: ransomware groups, business email compromise operations, and APT-adjacent criminal actors all have active campaigns targeting Nigerian enterprise.
The dwell-time problem manifests in Nigerian environments in a specific way. Nigeria faces gaps in specialized security staffing, and that shortage can extend dwell time. Many organizations have made significant investments in perimeter security firewalls, intrusion detection systems, and endpoint protection platforms. These investments are appropriate and necessary. But they address the question of whether attackers can enter, not the question of whether attackers who have entered are being detected and evicted. An attacker who bypasses perimeter controls through a phishing email, a credential stuffing attack on a cloud application, or exploitation of an unpatched vulnerability can operate inside a Nigerian enterprise network for months without triggering any alert from perimeter-focused security products, because those products are designed to detect ingress, not to monitor post-access behavior. The shutdown of Nigeria's National Bureau of Statistics is a warning for organisations across the country. Nigeria is increasingly responding through a Cybersecurity Coordination Council scheduled for establishment by September 2026.
The behavioral signals of an active attacker inside a network are detectable, but only if something is watching for them continuously to improve situational awareness and catch behavior that perimeter tools miss. The patterns that distinguish attacker behavior from normal user activity include:
• Lateral movement: authentication attempts from a compromised account to systems and resources that account does not normally access, particularly during off-hours or from unusual source endpoints
• Credential access: large-scale LDAP queries, Kerberoasting patterns, or attempts to access credential stores that normal users and service accounts do not touch
• Data staging and exfiltration: unusually large data transfers, access to file repositories outside normal user scope, or outbound connections to infrastructure not in the approved communication list
• Persistence mechanisms: scheduled task creation, registry modifications, or service installations outside maintenance windows on hosts that have not recently had software deployed
• Command-and-control communication: outbound connections to newly registered domains, connections using unusual protocols or ports, or beaconing patterns in network traffic regular small outbound connections at consistent intervals from a host that does not normally initiate external traffic
A managed SOC combines Security Information and Event Management with continuous monitoring to turn telemetry into actionable alerts. Managed SOC services also provide threat hunting and incident response when incidents occur. Managed services also help organisations meet compliance requirements when they lack the internal team to run 24/7 monitoring.
None of these signals are generated only by sophisticated nation-state attackers. They are the standard operational patterns of virtually every attacker category ransomware operator, financial fraud groups, and espionage actors all use the same post-access techniques because those techniques are effective. And all of them are detectable through continuous behavioral monitoring of network and endpoint telemetry, with analysts responding as threats develop. Building an in-house SOC costs an average of $2.86 million annually, and with the global shortage of cybersecurity professionals exceeding 3.5 million positions, outsourcing is often the practical response.
Endpoint protection platforms and firewalls are perimeter, and endpoint controls are designed to prevent known malware from executing and to block unauthorized network access. They are not designed to detect behavioral patterns of an attacker who is operating with legitimate credentials obtained through phishing, using living-off-the-land techniques that do not involve malware, or accessing systems through misconfigurations rather than known exploits, and longer attacker presence also lets them modify legitimate credentials and establish redundant command-and-control channels. The Pentagon breach involved unauthorized access through a legitimate-appearing entry point the kind of access that perimeter controls do not block and endpoint protection platforms do not flag, which increases incident response complexity and the need to preserve evidence. Continuous SOC monitoring covers the behavioral detection layer that these tools do not address and helps reduce that risk. Extended dwell time also lets attackers harvest intelligence that undermines operational security. Long-undetected access can also damage trust in defensive monitoring and complicate intelligence-sharing relationships.
Detection time in a monitored environment depends on the attacker's operational tempo and the specific techniques used. For common post-access behaviors lateral movement, credential access, data staging SHELT's SOC monitoring generates alerts within minutes of the relevant telemetry appearing, not days or weeks, with Security Information and Event Management acting as the correlation layer behind those alerts. The goal of continuous monitoring is to compress the dwell time from months to hours, focusing effort where it will matter most and giving organizations the opportunity to contain an incident before significant damage occurs, reducing the financial, legal, and institutional consequences of discovery after the fact through external notification or visible impact.
SHELT's SOC deployment for Nigerian enterprise environments is designed to integrate with existing infrastructure without requiring replacement of current security tools. Deployment should account for where sensitive data and personally identifiable information reside across the environment. The monitoring layer collects telemetry from existing network infrastructure, endpoint platforms, Active Directory, and cloud services, helping surface vulnerabilities and cloud misconfigurations, and processes it through SHELT's detection platform. Deployment timelines depend on environment complexity and existing logging infrastructure. Managed SOC support can protect Nigerian organisations in regulated sectors such as energy and healthcare, as well as enterprises that rely on contractors. It also helps preserve evidence, coordinate response, and support audits after a breach. Organisations should also expect a formal notice process and clear statement flow when affected users are notified after a breach. Contact SHELT for an environment assessment.
.png)
© SHELT 2023 Privacy Policy | Terms & Conditions
.png){kind=small}
