Online threats rarely announce themselves. The most damaging incidents today often start quietly: a single reused password, a believable phishing email, a malicious browser extension, a compromised vendor account. Then the attacker blends into normal…