Incident response · M365 forensics · tenant hygiene

We investigated the breach after your MSSP said nothing happened.

CyberRisk Services is a working incident-response practice, not a report factory. We've re-opened "closed" incidents and found a year of attacker dwell, 91 ignored alerts, and RCAs with placeholder text still in the body. When the deliverable matters — to your insurer, your counsel, or your board — the investigation has to actually be done.

Direct line to the principal — active incidents jump the queue; everything else gets a same-business-day reply.

BEC · persistence · M365

706 attacks. Five months. Two mailboxes.

A business-email-compromise campaign ran 706 coordinated attacks against two finance mailboxes for five months. One inbox rule exposed it — and a SIEM blind spot had hidden the rest.

Read the anonymized writeup →

AiTM · conditional access

Eighteen seconds between two continents.

A "perfect" Conditional Access geo block that never fired — because the attacker brought their own session cookie. The policy change that actually closes the gap.

Read the anonymized writeup →

SIEM gap · dwell time

One year of dwell. 91 alerts. Nobody looked.

A default SIEM connector hid an AiTM compromise for twelve months. One configuration change surfaced every victim in the tenant — and the question of what the MSSP was watching.

Read the anonymized writeup →

How an engagement works

Step 1 · Reach out

Email the principal directly

No intake tier, no ticket queue. Active incidents jump the queue; everything else gets a same-business-day reply.

Step 2 · Same-day scoping

30 minutes with the person who works the case

Scope, evidence sources, and a fixed plan — from the operator who will pull the logs, not a sales engineer.

Step 3 · The deliverable

Counsel-ready, evidence-sealed report

SHA-512-sealed case folder with an independent verification script. Written for your insurer, counsel, and board.

Who we work with · credentials

Mid-market CIOs · MSPs needing an IR partner · defense-contractor SMBs (CMMC-adjacent) Second opinions after an MSSP "all clear" are half our work Microsoft Partner Center · CSP indirect reseller · MPN #6297915 Sole principal: Robert Ayers — the person you call is the person who works the case In-house forensics tooling — browser SQLite triage, mailbox eDiscovery, detonation chamber Court-grade evidence handling — SHA-512 sealed case folders