The hardest thing to measure in security is what did not happen. The authority that did not go down, the document that did not leak, the production line that did not stop. Every incident here is real and published with the customer’s consent; identifying details were changed, and the timings are as recorded.
41seconds — the fastest detection in a ransomware event
0resident services lost in the local-authority incident
88mailboxes swept in the law-firm incident
34suppliers reviewed after the supply-chain incident
Three incidents
Three incidents, three outcomes.
Local authority
Ransomware stopped before it spread
Situation
A VPN logon from a service account with no MFA, at 02:40. The authority runs resident services that cannot go down.
Action
Two servers isolated in under three minutes, credentials reset, the command channel blocked.
Outcome
Not one resident service was interrupted, and no ransom was paid.
41Seconds to detect
2:58Minutes to contain
0Services lost
Law firm
An email leak stopped the same day
Situation
A forwarding rule was created and hidden inside a senior partner’s mailbox. Every incoming message was copied to an external address.
Action
The rule was found and removed, MFA enforced across every mailbox, and 88 further mailboxes swept.
Outcome
Not one client document left the firm. The disclosure duty was assessed and did not trigger.
88Mailboxes swept
0Days to discovery
0Documents leaked
Industrial manufacturer
The supplier was breached; the customer was not
Situation
A subcontractor’s remote access was used to try to reach the operational (OT) network.
Action
Supplier access cut, the OT network segmented, and a supply-chain review run across all 34 suppliers.
Outcome
The production lines kept running throughout.
34Suppliers reviewed
7Minutes to block
0Hours of lost production
INCIDENT REPLAY · IR-2026-0412
What a real incident looks like here.
The log of the local-authority ransomware incident, from detection to report.
TripleSOC · IR-2026-0412 · ransomwareCONTAINED
DETECTEDR: anomalous LSASS memory access by svc_backup on FIN-SRV-04
ALERTSIEM: three failed logons then one success from 10.4.19.77 — out of pattern
ACTIONTier 1 escalates to Tier 3. Incident IR-2026-0412 opened.
CRITICALFile-encryption behaviour on FILES01\finance — 147 files touched
ACTIONNetwork isolation applied to FIN-SRV-04 and FILES01 from the console
ACTIONThree accounts force-reset; every session revoked
ACTIONC2 domain cdn-update-check[.]net blocked at the perimeter
CONTAINEDEncryption stopped. All 147 files restored from the 23:00 snapshot.
CONTAINEDRoot cause: a VPN account with no MFA. Report delivered to the customer.
A real incident at one of our customers, published with their consent. Identifying details were changed; the timings were not.
In their words
What customers say.
“They called us at two in the morning, before we knew there was an incident at all. By morning every resident service was running normally.”Head of IT, local authority
“What impressed us was not the technology, it was the report. For the first time we understood exactly what had happened and what to change.”Managing partner, law firm
“Our supplier was breached. We were not. That is the whole story.”Operations manager, industrial manufacturer
Emergency line · 24/7/365
Under attack? Do not shut anything down. Call.
Shutting a machine down wipes volatile memory — and part of the evidence with it. Disconnect from the network if you can, delete nothing, and call. A senior analyst is on the line within 15 minutes, customer or not.