The Attacker Was Inside.
We Had Them Out in Five Minutes.

They Had One IT Person and No Idea What Was Already Inside Their Network.

This Greater Sacramento construction distributor was running a $60 million operation on a single IT generalist. He kept the day-to-day running, but cybersecurity had always been outside his scope. No monitoring. No audit logging. No identity controls. Files scattered across local machines and personal cloud accounts with no oversight.

When a new CFO came on board and pushed for a real security review, they brought in Vision Quest. Our risk assessment confirmed what the CFO suspected. But it also surfaced something the organization had not known: they had already been breached. Email accounts had been compromised in the past. The only evidence anyone had found was forwarding rules discovered after the fact, and emails that had quietly stopped arriving. There was no log of what the attacker accessed. No forensic trail. No way to know how long they had been inside or what they had taken. The breach had happened and closed without anyone understanding what it meant.

We Built the Visibility They Never Had. Then We Waited for the Next Move.

Every engagement starts with a risk assessment. We mapped the environment, documented the gaps, and got to work on what mattered most. Audit logging was turned on across their Microsoft 365 environment from day one. EDR went on every endpoint. We implemented conditional access policies and identity hardening to control how users authenticated and from where. We also recommended locking M365 access to Intune-managed, company-joined devices only. They were still working through that final step when the next attack came.

The difference between what we built and what existed before was not complexity. It was that for the first time, if something happened, they would know about it immediately and be able to account for every second of it afterward.

A Member of the Ownership Group Clicked a Phishing Link. Our SOC Was Already Watching.

A member of the ownership group received a phishing email, clicked the link, and entered their credentials. The attacker captured the MFA token in real time and stepped into the live Microsoft 365 environment. From their side, the login looked clean. From ours, something was already wrong.

Five Minutes of Access. One Record Viewed. An Insurer Who Did Not Need to Bring Anyone Else In.

The attacker had live access to a Microsoft 365 environment at a company doing $60 million a year. Five minutes later the session was dead and the damage was a single viewed PII record. No financial data. No bulk download. No lateral movement.

When the cyber liability insurer stepped in, they brought a breach coach attorney and an incident response vendor onto a call. Vision Quest showed up with a complete forensic record already prepared. We walked through exactly what the attacker accessed, exactly when, and exactly how we stopped it. The insurer did not need the IR vendor to do independent work. The breach coach had everything they needed to move forward. The claim was processed faster and more cleanly than anyone expected.

That result was only possible because we built the logging infrastructure on day one and ran the engagement assuming every incident would eventually end up in front of an insurer. That assumption proved correct. And it made all the difference.