Case studies
Each case study describes a real engagement with client-identifying and attacker-useful details removed: the starting condition, the investigation or method, and the verified outcome where it can be published — including what earlier attempts had missed. Published so a prospective client can see how the work actually goes before providing any access.
The case studies
Incident response · E-commerce
Three cleanups by other parties had not held. The fourth engagement treated the recurrence itself as the finding: every persistence layer was enumerated, access was reset, the likely entry condition was closed, and recovery was verified past the points where earlier cleanups had stopped.
Read the reinfection case studyServer audit · Membership site
An insurer questionnaire full of questions the business could not answer with evidence became a Linux server audit: every relevant answer was mapped to a verified control or an honestly recorded gap, then remediated and retested.
Read the insurance-review case studyForensic incident response · Online retail
A phishing run from an accountant’s Google Workspace account was the first visible sign. The forensic record showed three weeks of remote control over the accountant’s workstation through FleetDeck and two ScreenConnect clients, and tied the mailbox abuse to that machine by address, device and timing. The case study covers the evidence, the correlation, what containment cost and the legal follow-up.
Read the workstation takeover case studyCloudflare · Fleet security
More than 130 websites behind Cloudflare, where DNS, TLS, WAF behavior, access controls and change discipline had to stay consistent on every property. The case study covers the drift, origin exposure and access sprawl a fleet creates, and the baseline and review method that answer them.
Read the Cloudflare fleet case studyRelated reading