The present disclosure is directed to attack detection through signal delay monitoring. An example system may comprise at least one device including a physical interface. At least one signal delay monitor may determine whether a signal being transmitted to the device is received as expected at the physical interface and indicate a potential attack when the signal is determined to not be received as expected. Determining whether the signal is received as expected may include determining whether the signal is received within a window defining a time period in which receipt of the signal is expected. An example signal monitor may comprise at least a new data reception monitoring module and an expected reception window monitoring module. These modules may include logic to determine whether the signal is received within the window. An indication of a potential attack may trigger, for example, security-related actions in the system.