Report
What our first 430 million security events look like
Half of what our security monitoring reads arrives outside business hours. A small firm’s defences have to act when nobody is watching, and they need the logs that show what an attacker does once inside.
- Measured 26 Oct 2026, 00:45 AEST
- PDF, 6 pages, 305 KB
- BS-RPT-02, version 1.1
Executive summary
Our security monitoring analysed its first 430 million security events from 1 October to 26 October 2026, counted at 00:45 AEST. 420,450,384 events in the 24 full days from 2 to 25 October 2026, an average of 17,518,766 a day and more than 200 every second.
The stream is the record of what happens on every machine: which programs ran, which files they touched, who raised their privileges, what scripts executed, which domains were looked up, and who signed in from where. Most of it is routine. The line that matters is in there with the rest, and rules find it, because no person can read a stream this size.
49.8 per cent of events arrived outside 07:00 to 19:00 AEST, and 50.2 per cent inside it. The busiest hour was 22:00 to 23:00 AEST, with 5.96 per cent of a day’s events; the quietest was 07:00 to 08:00, with 2.96 per cent.
The stream does not keep office hours, and neither do the people who attack small firms. A business that only looks at its security during the working day is looking at half of what happens to it.
- Collect the logs that show what an attacker does after the first sign-in: process starts, PowerShell, privilege use and sign-ins.
- Let detection act at night without waiting for a person, on a short list of high-confidence threats, with every action reversible.
- Keep a phone number that is staffed when the alert fires.
Report
The figures
Events by hour of the day, AEST
Events by day, 2 to 25 October 2026
From event to response
Events become action in four steps. Every event is decoded and checked against detection rules as it arrives. A rule that fires raises an alert with the evidence attached. Alerts that meet a threshold go to the people who act on them on our own estate. And every event stays in the archive, so an investigation can go back over what happened before anyone knew to look.
- Central security monitoring of every system we run, with immutable log retention.
- Phishing-resistant multi-factor authentication on every account, with just-in-time administrative access.
- Application control and attack surface reduction enforced on managed devices.
- Immutable off-site backups, restore-tested every day.
Clients reach us on the 24/7 incident line: 1800 370 270. A call to the line rings through to our response team, and a call that is not picked up goes to voicemail and is returned.
Jetstone, our cyber defence software for Australian businesses, is designed to bring the same model to a firm with a handful of devices: the telemetry collected on the device, detection rules mapped to known attacker techniques, and a response that will act on its own against a published list of high-confidence threats, with every action undoable.
What to do
- Switch on PowerShell script block and module logging, process creation auditing and command-line capture on every Windows machine.
- Send sign-in logs from Microsoft 365 or Google Workspace somewhere they are kept for at least as long as an investigation needs.
- Keep DNS query logs: they are small, and they show which machine reached an attacker’s server.
- Write the short list of threats you would want stopped in the middle of the night without a phone call, and set your tools to act on those alone.
- Make every automatic action reversible, so the fear of a false alarm never stops you turning protection on.
- Check every day that each machine is still sending its logs. A silent machine is the one an attacker has switched off.
- Keep a number to call when an alert fires out of hours, and test that it answers.
Method
Every event counted here was received, decoded and checked against detection rules by our central security monitoring. The archive keeps each event whether or not a rule fired on it, so an investigation can go back over what happened before anyone knew to look.
The headline is the figure our running tally measured at 00:45 AEST on 26 October 2026, counting from the first archived day, 1 October. Our security monitoring analysed its first 430 million security events from 1 October to 26 October 2026, counted at 00:45 AEST.
The pattern figures cover every full day from 2 to 25 October 2026 in Australian Eastern Standard Time, so every hour of the day is counted the same number of times. We ran read-only aggregations over the archive on 26 October 2026: a count by hour of the day and a count by day. Events recovered later from backlog are left out, as the tally leaves them out.
No client is named. We print no count of devices, servers or users, no breakdown by source, and no count of alerts: an alert count measures how a rule set is tuned more than what happened.
BS-RPT-02, published 26 Oct 2026
The full report, as a PDF
PDF, 6 pages, 305 KB. Measured 26 Oct 2026, 00:45 AEST.
More reports
Report
Notifiable data breaches, read for small and mid-sized firms
OAIC figures of 6 Jul 2026, read 26 Oct 2026 · PDF, 7 pages, 230 KB
