Vectra Networks analyzes a quarter million endpoint devices in 40 enterprises. Every single network has some threats that sneak by perimeter defenses. Most of the activity was not yet at the most-dangerous data exfiltration stage. The most common technique attackers used to hide their communications was fake browser activity, at 36 percent, and newly-generated domains, used 25 percent of the time. The anonymous TOR network was used 14 percent of time, followed by external remote access at 13 percent.”]