9 months. 18,000 organizations. One missed log.
A nation-state actor embedded malicious code into a routine software update — trusted by every tool in the stack. Lateral movement went undetected for nine months because endpoint, identity, and network telemetry lived in separate, unconnected silos.



