Threat Pulse · Deep dive
Off-hours activity spike
Activity surged outside the agent's normal operating hours. When nobody is watching is when attackers prefer to work.
How we stop it
Operating-hour profiles per agent flag off-hours spikes. Suspicious activity is held for review instead of executing blind.
Frequently asked
What is off-hours activity spike?
Activity surged outside the agent's normal operating hours. When nobody is watching is when attackers prefer to work.
How does Rogue-Agent Defense stop off-hours activity spike?
Operating-hour profiles per agent flag off-hours spikes. Suspicious activity is held for review instead of executing blind.
What should I do if I see off-hours activity spike in the Threat Pulse feed?
Nothing urgent: the feed only shows attacks that were already blocked or flagged. If one class keeps appearing, review the linked defense guide and check your agents' allowlists, data boundaries, and spend caps.
Counts are real enforcement rows, anonymized. Attack classes seen in fewer than three workspaces never get a page.