The firm
A suburban accounting practice. Client files full of tax file numbers, payroll runs for half the businesses on their street, and a team that goes home at 5:30pm. Nobody on staff whose job is to watch the network, because that is not what an accounting firm is for.
They had been on the managed security service for a while. Most months, the monthly report is the only evidence anything is happening at all. This is the other kind of month.
02:47. The noise
The night started the way every night starts. A phishing email quarantined before anyone could click it. A failed sign-in from a location that made no sense, challenged and dropped. A macro blocked in an attachment pretending to be an invoice.
None of this woke anyone, because none of it deserved to. Triage exists so that noise stays noise.
03:08. The one that was real
A workstation began beaconing to a known malicious host. Not noise. Triage confirmed it as a genuine priority-one incident, and the 30-minute clock started at that confirmation, not at the first alert and not at start of business.
03:09. A responder picks it up
One minute into that 30 minutes, a named Ferres Systems responder picked it up and owned it end to end. Containment started straight away: the machine was isolated so it could not reach anything else, the access it was using was cut, the file server and the practice management system were checked for any spread, and the way in was closed. How long that takes depends on the incident, what access is available and which systems are involved. On this night it was a single workstation, which is about as contained as these get.
Nobody at the firm was called, because nothing about the situation needed them. Their phones stayed dark.
07:58. The write-up
Before start of business, the partner had a short write-up in plain English. What happened, what we did, and the answer to the only question that really matters: is this notifiable? It was not. No data left the environment, and the write-up explained how we knew that in one paragraph they could forward to their insurer.
The firm opened at 8:30am as usual. Most of the staff never knew there had been a night at all.
What changed afterwards
One hardening change rolled out that week, closing the specific way in. Staff got a short, blame-free briefing on what the lure had looked like. The next monthly report went back to being boring, which is the goal.
The commitments underneath this story
The details above are a composite and the identifying details are changed. The commitments are not: 24/7 monitoring and triage across endpoints and Microsoft 365 identities, and for clients on the managed security service, a named Ferres Systems responder picking up a confirmed priority-one incident within 30 minutes of triage confirming it, at any hour. Containment starts promptly and takes as long as the incident needs. Initial response and containment are included in every managed plan; extended investigation, rebuilds and remediation are billed separately. And a write-up you can actually read. If you want to see a night like this from the inside, the Managed Security page walks you through one.
