Because of the overtly destructive nature of the attack, it is unlikely that a definitive answer will ever be gained on the exact timing of Rhysida’s entry into the Library’s estate. However, forensic investigation and analysis of records indicates the strong likelihood that the criminal actors initially gained access at least three days before the incident became apparent.Translation: we weren't logging sufficient data into our SIEM. I know it's expensive, but this is why you spend that money.