Stopping the Attack Was Only Half the Job
- Contain
- Trace the entry point
- Close the gap
Situation
A compromised user account at a large financial services organization.
What we did
Contained the account, traced how the attacker got in, and closed the weakness they used.
Outcome
Device-code phishing identified as the entry point and shut down.
Stopping an attack isn't the same as understanding it.












