Cybersecurity That Thinks Ahead™
Cybersecurity That Thinks Ahead™
Illustrative Business Case
This is a fictional scenario showing how an investigation could proceed. It is not a verified customer incident or a guarantee of results.
Company profile: A mid-sized business with a small internal IT team.
Service: Managed Detection and Response (MDR).
The company’s small IT team handles user support and keeps business systems running. It reviews security alerts during the day but needs specialist support when suspicious activity requires investigation.
An unusual sign-in on an employee’s account triggers an alert later that evening. The analyst needs to establish whether the access is authorized and whether related email or endpoint activity points to a threat that has bypassed prevention.
Axelris Technologies monitors the customer’s identity, email and endpoint activity around the clock within the agreed coverage. In this example, an on-duty analyst begins investigating within two minutes of the alert.
The analyst looks at the sign-in records from VPN services, Windows Active Directory and Microsoft Entra ID, including those related to Microsoft 365 activity. Source-IP reputation and multifactor authentication events are used to determine if the access is legitimate.
The review also includes an examination of relevant mailbox activity, email authentication checks, attachments and links. Application permissions and evidence from the endpoint are reviewed for any signs of additional unauthorized activity.
Once unauthorized access is confirmed and the incident is rated high or critical, Axelris Technologies carries out the actions authorized in the customer’s onboarding runbook, subject to the agreed service terms.
Authorized actions can include revoking active sessions and tokens, blocking sign-in or temporarily disabling the account. A specific attacker IP can be blocked at the perimeter firewall where permitted. An involved device can be isolated through endpoint detection and response (EDR).
Any actions that go beyond the permitted ones are sent to the customer’s designated contact for approval. This applies to changes involving VIP, shared, service or emergency-access accounts, as well as to wider firewall or tenant-wide blocks, and to device wiping or reimaging.
Approval is also required when removing mailbox rules or application permissions beyond the agreed scope.
Axelris Technologies notifies the designated contact and documents the evidence, timeline and response actions.
The internal IT team handles remediation with guidance from Axelris Technologies. This may include resetting passwords and removing unauthorized changes before account access is restored.
Axelris Technologies checks the monitored environment for related suspicious activity. Any wider incident response or digital forensics work follows the agreed scope.
The findings and response record give IT a basis for remediation. Restricting the affected account aims to limit further attacker activity while the team works to restore appropriate access.
Fictional testimonial concept. This is not a customer quotation.
“When the alert came through, Axelris Technologies checked the account activity and explained what needed attention. Our IT team received the findings and a record of the response, which helped us decide what to fix and when access could be restored.”
Proposed speaker (fictional): IT Manager at a mid-sized business.