It rarely looks like an alarm

Breaches are typically discovered late, and often by someone else: a customer reporting something odd, a researcher making contact, data appearing for sale, or a cloud bill arriving.

The industry average time to detect is measured in months. The attacker was not fast. Nobody was watching.