Case Study
Business Email Compromise — Investigation and Containment
Professional ServicesProfessional Services Firm
The problem
Challenge
A business email compromise. Attacker access of unknown scope and duration, and no clear picture of what had been reached.
What I did
Approach
Ran the forensic investigation to establish scope and timeline. Contained the compromise and hardened the identity layer — Microsoft 365 and Entra ID configuration, access controls, and authentication policy.
Outcome
Result
Compromise contained and scope established. Identity infrastructure hardened against the attack path that was used.
Involved
Incident ResponseDigital ForensicsMicrosoft 365Entra IDIdentity Hardening
The service
Work of this kind
This engagement is the sort of thing covered by fractional CISO and CTO. The full list is on the case studies index.
Something similar in front of you?
Tell me what you are dealing with and I will tell you what it involves, including whether you need me at all.