On average, it takes six months to detect a data breach and another three to contain it. Some signs of security compromise are obvious — receiving a threat alert sudden network latency, or finding a ransom note — but there are several subtle clues, too.