Business Email Compromise: Investigation and Containment
Challenge
A business email compromise. Attacker access of unknown scope and duration, and no clear picture of what had been reached.
Approach
Ran the forensic investigation to establish scope and timeline. Contained the compromise and hardened the identity layer: Microsoft 365 and Entra ID configuration, access controls, and authentication policy.
Result
Compromise contained and scope established. Identity infrastructure hardened against the attack path that was used.
Work of this kind
This engagement is the sort of thing covered by post-incident remediation, and fractional CISO. The full set is on the case studies index.
Something similar in front of you?
Tell me what you are dealing with and I will tell you what it involves, including whether you need me at all.
Bring your FDA letter, pen test report, audit deadline, or architecture problem. You'll talk to me, not a sales rep.
Not ready for a call? Send a message instead.
For companies looking to engage BATO. Vendors, please email.