Last year, during a midnight incident response exercise, I misidentified an attacker’s lateral movement because a critical log event in Microsoft 365 arrived twenty hours late.