Engagement case studies
Key takeaways
- Each case names the actual problem, the specific actions taken, and what changed afterwards.
- Client names and identifying details are withheld or altered in every case.
- The most common finding is not a sophisticated exploit — it is a process or configuration gap.
- Every assessment case ends with a retest, and the retest outcome is stated.
Ransomware containment and recovery — 340-employee manufacturing group, Kerala
The situation
A production server was encrypted during business hours. The first hour was spent isolating the affected host rather than restoring anything, because the operator's next move was predictable.
What we did
The affected server was isolated within 40 minutes, shadow copies were confirmed intact before they were touched, and the business resumed on a restored host the same day. The entry point was an unpatched remote access appliance, and a segmentation gap meant one compromised credential reached the finance VLAN. Both were closed, and a retest confirmed the path was dead.
What it changed
A single compromised credential reached the finance network. Isolation happened before recovery, the entry point was an unpatched remote access appliance, and the segmentation gap is now closed with a verified retest.
Business email compromise defence — 900-person services firm, Karnataka
The situation
A finance team was targeted with a genuine thread and a genuine-looking change of bank details. One payment was released before anyone noticed.
What we did
A callback and dual-approval procedure for bank detail changes, enforced in the finance workflow. A controlled phishing simulation then tested whether the new procedure held, and the retest showed the click rate dropping and reporting rising. No malware was involved in the original incident, and none would have been detected by antivirus.
What it changed
A single released payment was followed by a callback and dual-approval rule for bank detail changes, verified by a controlled simulation. This was a process failure, not a malware incident.
Deepfake takedown and monitoring retainer — public figure, Kerala
The situation
A synthetic voice clip of a public figure was circulated in a scam call to family members. It spread for roughly 36 hours before the first takedown request.
What we did
The clip was confirmed synthetic, captured as tamper-evident evidence with the detection signals recorded, and removed from the platforms where it appeared. A monitoring retainer was set up so the next attempt was caught within hours, and a family verification code word was established to blunt the voice-clone route specifically.
What it changed
A synthetic voice clip used in a family scam was confirmed, evidenced and removed, and a monitoring retainer plus a family code word were established so the next attempt is caught earlier.
External penetration test and retest — SaaS platform, Delhi NCR
The situation
A Series A company needed a security assessment for a large enterprise procurement process, with a deadline that was shorter than a typical assessment.
What we did
An authenticated web and API test across the customer-facing application, with a technical report and a one-page summary formatted for the buyer's security reviewer. The critical finding was a broken object-level authorisation flaw, where one customer could read another's data by editing an identifier — the kind of issue generic scanners miss and it is exactly what enterprise reviewers test for.
What it changed
A broken object-level authorisation flaw meant one customer could read another's data. It is the most common serious API bug and the one enterprise security reviewers test for specifically.
Access review and offboarding fix — multi-site services company, Maharashtra
The situation
A leaver's credentials had remained active for four months, and a shared service account was in use by three people.
What we did
A privileged access register, offboarding recommendations, and a shared-account remediation plan — plus a working test of the joiner-mover-leaver process, because a process that is never tested is a process that does not work.
What it changed
Four months of stale access from a leaver, plus a shared service account used by three people. The fix was a privileged access register and a tested joiner-mover-leaver process.
What these have in common
Read across all five, and the pattern is consistent. In four of the five, the initial compromise was not a zero-day and not a sophisticated intrusion. It was an unpatched appliance, a shared credential, a process gap, or a human voice being cloned. The technical sophistication of the attack matters far less to your risk than whether your controls would have caught it, and in every case here, they would not have.
On publishing case studies at all
Some firms do not publish engagement detail because clients do not want it known that they were breached. That is a legitimate position and we respect it. We publish because the value is in the pattern rather than the identity: if a manufacturing group in Kerala and a services firm in Karnataka both had the same gap, you are probably going to have the same gap, and knowing about it in advance is the whole point of publishing.
Want to talk about your situation?
Most engagements start with a short scoping call. We will tell you what the work should cover and what it will cost.
Request a quote See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.