Having responded to multiple incidents across sectors, can confirm that extensive reconnaissance and long term operations are becoming a norm. During one instance, the attackers were present in the system of a client for more than 18 months and had gained an amazing understanding of their operational procedures, policies and security architecture to say the least.