Slow Pulse

You are reviewing a day of connection records. Korgan Insurance JSC is an insurance company. A network engineer noticed traffic leaving the office at night, when nobody is there, and handed the export to you.

There are no packet contents here — only who, where, when and how many bytes. That is enough: regularity and volume are visible without decryption, and most traffic is encrypted anyway.

Start by looking for regularity, not size: people do not open a connection every few minutes to the second.