Demos / Security and compliance
Demo · 1:11
Email compromise
A hidden forwarding rule found, switched off but kept as evidence, and the account locked, on one ticket.
Recorded on the real product against our demo company, Lakefront Works. The people and data are fictional.
Transcript
Monday, ten past eight. A supplier calls finance: an email about one of Lou Brown's invoices looked odd. Sasha, Lakefront's security analyst, opens a ticket and checks every mailbox for mail leaving the company. One run, every mailbox.
One mailbox stands out. Lou has a rule named just a dot. Any mail that mentions an invoice, a payment or a wire is sent to an outside address, moved out of sight and marked as read, so Lou never sees it. That is what a hijacked mailbox looks like.
Sasha right-clicks Lou and switches the rule off. It is disabled, not deleted, so the investigation can still see exactly what it did and when. Then she locks the account. Sign-in is blocked and every session is signed out, so whoever got in is out as well.
Minutes after the call, it is contained. Every step is on one ticket: what was found, what was changed, by whom, with the full output.