Cybersecurity scenarios and analysis

What does a security audit involve, step by step?

Is an audit just running a vulnerability scanner? A professional IT security audit is a diagnostic process leading to a risk map and action plan, with scanning as one tool. Each stage has an agreed scope and roles, so the organisation knows the outcome in advance. Explore the sequence from the opening meeting to a prioritised report.

A cyberattack on a manufacturer: from phishing to halted production

What does an attack on a manufacturing company involve? Explore a realistic scenario and how security monitoring and SOC help limit impact.

What happens after a Microsoft 365 account is compromised? An attack scenario

An employee receives a message asking them to sign in to Microsoft 365 again. The page looks familiar, so they enter their username and password and approve an MFA request. A few minutes later, a cybercriminal signs in to their account. The user continues receiving email and working as usual. For the attacker, however, this is only the beginning.

How does an Incident Response team stop a cyberattack, step by step?

It is 02:17. EDR detects an unusual process launch on a user’s workstation, and SIEM links it to a corporate cloud sign-in from a new location. Email works, servers respond and employees are asleep. From a business perspective, nothing has happened yet. For the security team, a race against time has just begun.

Inside a modern 24/7 SOC: how a security operations centre works

What does a modern security operations centre do? We show how a 24/7 SOC detects threats, analyses incidents and coordinates response before a cyberattack affects business operations.

A day in the life of a SOC analyst: inside 24/7 security monitoring

What does a routine SOC analyst shift look like? We follow the path from the first alert through analysis and escalation to incident response in a security operations centre.

The alert appeared at 2:13 a.m. The administrator saw it at 8:04 a.m.

A delay of several hours can completely change an incident’s course. We explain how missing 24/7 monitoring allows attackers to compromise further systems before anyone responds.

The company had EDR. Ransomware still encrypted the entire network

EDR alone does not guarantee security. This educational scenario shows how a lack of analysis and response can allow ransomware to spread through an IT environment.