Case studies
Each case study describes a real engagement with client-identifying and attacker-useful details removed: the starting condition, the investigation, and the verified outcome — including what earlier attempts had missed. Published so a prospective client can see how the work actually goes before providing any access.
The case studies
Incident response · E-commerce
Three cleanups by other parties had not held. The fourth engagement treated the recurrence itself as the finding: every persistence layer was enumerated, access was reset, the likely entry condition was closed, and recovery was verified past the points where earlier cleanups had stopped.
Read the reinfection case studyServer audit · Membership site
An insurer questionnaire full of questions the business could not answer with evidence became a Linux server audit: every relevant answer was mapped to a verified control or an honestly recorded gap, then remediated and retested.
Read the insurance-review case studyRelated reading