Loading...
An organization in a regulated industry with statutory reporting obligations engaged us after detecting unauthorized access to internet-facing systems. Their team had responded quickly, isolated what they had found, and reported the incident contained.
It was not contained. Our first task was not analysis but verification, and verification established that access persisted after the incident had been closed out — across more accounts than the initial response had identified, and reaching systems where regulated data was available. The response had been competent. It had been working from an incomplete picture, which is the ordinary condition of a team responding to its own incident under pressure.
The second finding mattered as much. The entry point the organization believed had been used was not the one that mattered. Remediation aimed at the assumed route would have closed something real while leaving the actual path open, and everyone involved would have believed the matter was finished.
We established genuine containment, then reconstructed what had happened from evidence: which accounts were affected, over what period, and — critically — which records were demonstrably opened inside an attacker-controlled session. That set was enumerable and evidenced, rather than assumed.
Every finding in the report carries a confidence marking. Facts proven from artifacts are distinguished from findings corroborated across sources, from inferences, and from questions the available evidence cannot settle. Where a logging gap meant a question could not be answered, the report says so plainly and explains what would have been required to answer it.
Whether a notification requirement exists is a legal determination, and our reports do not make it. What counsel needed was an evidenced, bounded account of what was actually accessed, with the uncertainty stated rather than smoothed over. Counsel could reason from that. The alternative — an unevidenced narrative — leaves an organization reasoning from absence, and reasoning from absence tends to end in treating everything that might have been touched as though it had been.
The investigation also identified the control gap that had made part of the question unanswerable in the first place, which is usually the finding with the longest shelf life.
Challenge: An incident had been investigated, isolated, and reported contained. Finding: It was not — and the entry point the organization believed had been used was not the one that mattered. Outcome: Genuine containment, and an evidenced, enumerable account of what was actually accessed, with every finding marked for the confidence it carries.