Bot attacks go undiscovered for average of 16 weeks