Real threat patterns. Illustrative responses.

The Silent Infiltration

Nation-State APT pattern

Illustrative: a spear-phish against a procurement officer leads to quiet lateral movement and credential harvesting — the kind of low-and-slow activity legacy SIEMs often under-prioritise.

Illustrative loop: See/Think notice unusual service-account access outside normal patterns and correlate related micro-anomalies on the premises. Operators get a narrative — not a claim of a fixed minute SLA.

Illustrative Act → Verify: contain under policy, re-check that containment held, then Tell a plain-language account for your operators. Optional light Aegis support if you want help framing next steps — not a staffed 24/7 SOC claim.

Overnight Encryption Pattern

Ransomware overnight

Illustrative: ransomware-like encryption behaviour starts on file shares after a compromised VPN credential — often after days of quiet persistence.

Illustrative: the on-prem loop flags anomalous write/entropy patterns and can trigger policy-driven containment. We do not invent “under N seconds” detection guarantees here.

Illustrative: Act isolates affected paths where policy allows; Verify re-checks the outcome per host/segment; Tell briefs your operators in the morning. Restoration depends on your backups and staffing — not an invented on-call SLA.

The Device Pathway

Medical device pathway

Illustrative: compromise of a vendor remote-monitoring gateway, then attempted movement from a biomedical VLAN toward IT — a care-delivery risk as much as an IT one.

Illustrative: See/Think flag disallowed VLAN-to-VLAN behaviour (scanning, credential testing) that should never occur between clinical and IT segments.

Illustrative: Act severs the bad pathway under policy; Verify confirms it stayed severed; clinical devices are not casually disrupted. Your clinical engineering and IR process own device follow-up.

The Treatment Plant Probe

OT reconnaissance

Illustrative: internet-facing contractor remote access reaches toward SCADA HMI themes — reconnaissance against chemical dosing parameters rather than immediate sabotage.

Illustrative: unusual accounts, sources, or OT parameter queries that match no known operator workflow raise operator signals on-prem.

Illustrative: terminate the session, suspend the contractor path, preserve evidence for your OT specialists and any agency notifications you choose. Light Aegis support is optional capacity — not a flying squad claim.

The Evidence System Probe

Evidence system abuse

Illustrative: social-engineered VPN credentials used to probe digital evidence systems — seeking case files and witness-related material.

Illustrative: behavioural signals when an account accesses case material far outside its unit baseline. No invented “340% above baseline” scorecards.

Illustrative: constrain the account under policy, preserve logs, involve your IA/prosecution process. Court outcomes depend on your counsel — we do not invent them.

The Suspect Update

Supply-chain update risk

Illustrative: a routine vendor update package that passes basic signing checks but carries undocumented callback behaviour — supply-chain risk against CUI-adjacent systems.

Illustrative: anomalous update behaviour and policy gates before broad rollout — operator review before trust. We do not claim a magic “binary deep analysis platform” product name here.

Illustrative: hold deployment, Verify the hold, notify the vendor through your process, scan for prior exposure. Government partner notifications are yours to make.

The Wire Transfer Fraud

Business email compromise

Illustrative: after credential phishing, an attacker learns payment cadence and spoofs a large vendor wire authorisation while the officer is on leave — dollar amounts vary; we do not invent them.

Illustrative: lookalike domains, process mismatches (no sent copy of an “authorisation”), and out-of-band verification themes. Email security may be adjacent tooling — not a claimed 0g0 “email platform.”

Illustrative: hold payment pending human verification; re-check vendor banking out-of-band; secure the mailbox. Your finance controls remain the backstop.

The Records Exfiltration

Student records exposure

Illustrative: SQL injection in a legacy SIS web app enables systematic student-record theft over several days — a privacy and regulatory event.

Illustrative: anomalous outbound transfer patterns and application abuse signals on-prem. Optional external exposure signals are discussion topics — not a claimed “dark web intelligence platform” for every customer.

Illustrative: take the vulnerable app offline, scope the database, follow your notification laws. Light support can help frame evidence trails — not invent statutory compliance outcomes.

The Grid Probe

EMS / OT reconnaissance

Illustrative: multi-week reconnaissance against EMS/OT pathways — mapping IT–OT bridges without immediate outage commands.

Illustrative: correlated low-confidence signals that together look like known grid-targeting patterns. Operators decide escalation — no invented 34-day clock guarantees.

Illustrative: monitor carefully, then evict under a planned window; harden re-entry paths. Agency notifications (CISA, NERC, etc.) follow your process.

The Record Manipulation Attempt

Record integrity

Illustrative: stolen clerk credentials used to attempt modification of protected case-management records and evidence submissions.

Illustrative: integrity / unusual-access signals when an account touches case files it has never owned. Write-blocking under policy where configured.

Illustrative: suspend access, preserve audit trails, notify court admin/judge per your process. “Court-admissible” is a legal determination — we do not invent it.

The Integrity Probe

Pre-election probing

Illustrative: spear-phish of election officials, probing of registration systems, and noise aimed at public confidence — technical and narrative pressure together.

Illustrative: lookalike domains, probing of election-related systems, and operator prioritisation of those signals. We do not claim a dedicated “election security monitoring platform” product.

Illustrative: disrupt vectors as found, brief election officials, coordinate with your state CISO and partners as you choose. Transparency reporting is a policy choice.

The Market Intelligence Theft

Pre-decisional data theft

Illustrative: compromised analyst account used to bulk-access pre-decisional regulatory documents for illicit trading advantage.

Illustrative: access patterns inconsistent with role and hours — bulk pre-decisional reads across teams. No invented day-count guarantees.

Illustrative: constrain the account, preserve evidence, involve your OIG/LE process. Analyst may be victim of remote access — investigate before assuming malice.