One family of intrusions investigated by Google’s Mandiant unit last year sat inside victim networks for an average of 393 days before anyone noticed. Most of those victims could not reconstruct how the attack started.

The reason wasn’t necessarily a failure to collect the evidence. In many cases, organizations simply didn’t keep the proof long enough.