AnswersPublished16 sources
ExtraHop’s Singapore findings show ransomware detection is coming too late
ExtraHop reports that 47% of Singapore ransomware victims detected breaches only after data theft, up from 15% a year earlier; attackers remained inside networks for nearly 2.5 weeks on average.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- ExtraHop reports that 47% of Singapore ransomware victims detected breaches only after data theft, up from 15% a year earlier; attackers remained inside networks for nearly 2.5 weeks on average.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What do ExtraHop’s findings reveal about Singapore enterprises’ ransomware detection failures—including the rise from 15% to 47% detecting b. Article summary: ExtraHop’s findings point to a failure to detect intrusions before attackers achieve their objectives—not simply a failure to prevent entry. The reported jump in detection only after data theft, together with roughly 2.5. Topic tags: general, education, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, cha
ExtraHop’s Singapore findings highlight a gap between an attacker entering a network and defenders recognising the intrusion. Nearly half of ransomware victims in the report detected the breach only after corporate data had been stolen, while attackers spent close to two and a half weeks inside networks before detection on average.6 That points to a need to identify and contain intrusions earlier—not just block attempted entry.
The clearest signal is detection after data theft
The share of Singapore ransomware victims who detected a breach only after data theft rose from 15% the previous year to 47%, according to reporting on ExtraHop’s findings.6 That is a 32-percentage-point increase. The same report put average attacker dwell time in ransomware incidents at nearly 2.5 weeks.
6
These measures describe different aspects of the problem: one is when victims noticed a breach relative to data theft; the other is how long attackers were present before detection. Together, they suggest that defenders may be missing opportunities to investigate suspicious activity and contain an intrusion before it reaches a damaging stage. They do not, on their own, identify why detection was delayed or show that every affected organisation experienced the same sequence.
Attempted attacks and successful breaches are different measures
Kaspersky reported blocking more than 70,000 exploit attacks targeting businesses in Singapore in 2025, out of more than 2 million across Southeast Asia.37 That helps illustrate the volume of attempted activity, but blocked exploit attacks are not the same as confirmed intrusions, unique victims or ransomware incidents. The Kaspersky figures therefore provide context for attack pressure; they do not explain the ExtraHop detection findings or establish a connection between particular attempts and the reported breaches.
AI risk figures need to be read in context
A separate survey cited in Singapore business reporting found that 32% of respondents identified AI agents, agentic infrastructure and generative AI applications as their organisation’s biggest cybersecurity risk.37 QBE’s survey, reported separately, found that 39% of Singapore businesses had experienced at least one AI-related cyber event in the past year—the highest rate among the markets it surveyed.
43 Those measures capture different things: perceived risk in one survey and reported events in another. An AI-related event is not necessarily a confirmed breach.
ExtraHop has also reported that 85% of organisations experienced an AI-rooted security incident, data exposure or near miss.2 That figure is an organisation-level measure and should not be presented as Singapore-specific or directly compared with QBE’s event rate. Singapore’s Cyber Security Agency has separately described an increasingly complex, AI-enabled threat landscape.
36
The sources provided do not substantiate the specific Singapore percentages for encrypted-channel visibility, alert fatigue, legitimate-looking activity or high-privilege permissions, nor the claimed rise in discoveries made only upon receiving a ransom demand. A separate report gives different figures for ransom-demand discovery, but the supplied excerpt does not establish those as Singapore-specific.8 The cited material also does not verify the proposed ranking of named threat groups in Singapore. Those details should not be treated as established explanations for ExtraHop’s detection findings.
What the findings mean for defenders
The strongest conclusion is also the narrowest: in the reported Singapore ransomware cases, detection often came after data theft, and attackers had time to remain inside networks before being discovered.6 The figures do not prove which controls failed or whether AI, a particular threat group or a specific access method caused the delays.
For organisations, the practical priority is to shorten the time between suspicious activity and a confirmed response. That means reviewing how quickly teams can investigate unusual network and account activity, identify what happened and contain an intrusion. Attack-blocking remains important, but the Kaspersky figures should not be mistaken for evidence that attempted attacks were successful; the ExtraHop findings underline why organisations also need to assess their ability to detect and respond after an attacker gets in.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "ExtraHop’s Singapore findings show ransomware detection is coming too late"?
ExtraHop reports that 47% of Singapore ransomware victims detected breaches only after data theft, up from 15% a year earlier; attackers remained inside networks for nearly 2.5 weeks on average.