The Trigger
A financial advisory firm had recently signed with PRETERION for managed IT support. They were pleased with the proposal, comfortable with the process, and — as they mentioned in their final onboarding meeting — broadly confident in their security posture. They believed they were, by and large, doing fine.
On the first day of deploying PRETERION’s tools and policies into their Microsoft 365 environment, an alert fired. A user account was showing active login activity from an overseas IP address. The account belonged to a staff member who hadn’t travelled anywhere.
The Challenge
The investigation confirmed what the alert suggested: the account had been compromised. A staff member had clicked a link in a phishing email weeks earlier, silently handing their credentials to an attacker. For that entire period, the breach had gone undetected — no monitoring, no alerting, no policies in place to flag the anomaly. The attacker had access to emails and files across the business.
For a firm holding sensitive client financial information, the exposure was serious. The business now faced not just a security incident, but a legal and regulatory one.
The Solution
PRETERION moved immediately to contain the breach — isolating the compromised account, revoking active sessions, and blocking the attack vector before any data could be exfiltrated. The timing was fortunate: the breach appeared to have been automated, and the attacker had not yet acted on their access. The window to stop it had almost closed.
From there, PRETERION coordinated with a specialist cybersecurity firm brought in to conduct a full forensic audit, supported the business through its legal obligations — including mandatory notification to the relevant government regulatory body — and then deployed the complete Microsoft 365 security suite across the organisation. Conditional access policies, multi-factor authentication, endpoint protection, and ongoing monitoring were all implemented and configured. Staff completed security awareness training with a focus on identifying phishing attempts.
The business that had believed it was doing fine now had the posture to prove it.
Before / After
Before PRETERION:
- No security monitoring or alerting in Microsoft 365
- No multi-factor authentication enforced across user accounts
- No conditional access policies — overseas login from an unknown device raised no flags
- Active breach running undetected for several weeks
- Staff with no formal training in identifying phishing emails
After PRETERION:
- Breach detected and contained on day one of onboarding — before data was exfiltrated
- Full Microsoft 365 security suite deployed: MFA, conditional access, endpoint protection, alerting
- Forensic audit completed; regulatory notification obligations met
- Organisation-wide phishing awareness training completed
- Ongoing monitoring in place — anomalous activity flagged automatically
Benefits
- Breach contained before any client data was lost — avoiding what would have been a significantly more serious regulatory and reputational outcome
- Full compliance with mandatory data breach notification obligations under Australian privacy law
- Security posture transformed from reactive and invisible to proactive and monitored
- Staff now equipped to recognise and report phishing attempts before they become incidents
- Business operates with documented, enforceable security policies for the first time
Client Quote
“We thought we were on top of it. We weren’t — and we had no way of knowing until PRETERION’s tools went in. The timing could not have been closer. I don’t want to think about what another few weeks would have looked like.”
— Principal, financial advisory firm, Sydney
Is your business in a similar situation?
Book a free 30-minute IT Maturity Review — no obligation, no sales pitch.