Business cybersecurity

What actually happens in the 20 minutes after a click

Every security conversation starts with “don’t click.” Nobody explains what happens next when someone does — which is the part that decides whether it costs you anything.

Comstel ICT · Cybersecurity · September 2026

Your staff are busy, the fakes are convincing, and attackers only need one person distracted once. A security setup built on the assumption that nobody ever makes a mistake isn’t a security setup. It’s a hope.

So assume the click happened. Here’s the next twenty minutes, and where each layer intervenes.

1. 0:00 — the clickA file downloads, or a convincing fake login page opens. Prevention: web and network attack defence blocks known-bad destinations before the page loads at all. The overwhelming majority of attempts end right here, and nobody ever knows about them.
2. 0:30 — executionThe file tries to run. Prevention: behavioural analysis and anti-exploit examine what it’s attempting rather than what it is, which catches malware no signature has seen before.
3. 2:00 — establishing a footholdIt attempts persistence and reaches out to a command server. Detection and response: EDR records the full sequence, so afterwards there’s a timeline instead of a mystery — what ran, what it touched, which machines it reached.
4. 8:00 — moving sidewaysIt uses harvested credentials to reach other machines and file shares. Extended detection: identity, cloud and network sensors correlate activity across systems, so a sequence that looks harmless on one laptop is recognised as an attack in progress.
5. 15:00 — the payloadEncryption begins, or data starts leaving. Ransomware mitigation: tamper-proof backups allow affected files to be restored automatically rather than negotiated for.
6. 20:00 — someone respondsEither a person is watching, or nobody is until morning. Managed detection and response: a 24/7 team investigates and contains it while your office is closed.

The gap most small businesses have

Good tools, and nobody with time to operate them.

Alerts arrive at inconvenient hours and dashboards don’t investigate themselves. Plenty of businesses buy excellent security software and then have no one whose actual job is to act on what it reports. That’s the gap, and it’s where the losses happen.

What Comstel does

We’re an authorised Bitdefender partner. We size GravityZone to your business, deploy it, tune it and manage it from Sydney — including managed detection and response options where a team investigates alerts around the clock.

Prevention, detection, extended detection and managed response run from one platform and a single lightweight agent across Windows, macOS, Linux and iOS.