Push bombing and a $180,000 detection budget
Vantage Loop is a 220-person B2B SaaS company. All staff use push-based MFA; the help desk resets MFA by asking callers for their employee ID and manager's name, both of which appear on LinkedIn and in email signatures. On a Tuesday, a support engineer receives 41 push prompts between 22:00 and 03:00 and approves one to stop the noise. The attacker enrols a new authenticator, creates an inbox rule that hides messages containing 'invoice', and reads three weeks of support tickets. Nobody notices until a customer asks why their ticket was answered from a personal-looking address, nine days later. The security lead has three options for next quarter's budget: number-matching MFA for everyone (about $0 incremental, three weeks of engineering), FIDO2 keys for the 45 privileged users ($6,000 plus rollout), or a 24/7 managed detection service ($180,000 per year).
1. Rank the three options and justify your ranking using the specifics of the incident.
Read the worked answer
Ranking: number matching, then FIDO2 for privileged users, then managed detection - with one caveat about what management may actually be buying.
- Number matching ($0, three weeks): it defeats precisely the attack that succeeded. The user must type a code shown in the originating session, so 41 blind prompts become 41 useless prompts. Highest risk reduction per dollar by a wide margin.
- FIDO2 for the 45 privileged users ($6,000): phishing-resistant and cheap, so do it - but it covers 45 of 220 identities, and a support engineer was the compromised account, so the victim is probably not in that set. It hardens the crown jewels, not the exploited path.
- 24/7 MDR ($180,000): buys detection, not prevention. The intrusion was human-detectable (a new authenticator, a mailbox rule, overnight access to ticket data). The same money spent on phishing-resistant authentication plus identity alerting removes the path rather than watching it. At this company's size, MDR loses on cost-effectiveness.
Caveat: if leadership's actual requirement is 'we must detect anything within hours', the near-free answer - alert on mailbox-rule creation, new authenticator enrolment and impossible travel - should be deployed before the SOC conversation, and it may change what the SOC is asked to do.
2. After the ranked fixes are deployed, what residual risk remains, and how would you state it to the executive team?
Read the worked answer
The residual risk is the help desk, not the authenticator. The attacker never needed to break MFA; they needed a plausible caller. Reset verification by 'employee ID plus manager name' - both published on LinkedIn and in signatures - is an identity-theft kit, and number matching does not touch it, because the reset happens through a legitimate channel.
State it with a mechanism and a number, not with reassurance:
After the planned controls, a competent social engineer can still take over a support account by calling the help desk with public information. That exposes customer ticket contents for a median of nine days before a human notices, and today we have no monitoring for device enrolment or mailbox-rule changes.
Use what the incident already measured: three weeks of ticket data, nine days to detection, zero identity-event alerting. Then name the cheap next step - callback to a number from the HR record rather than a number supplied by the caller, plus out-of-band approval for authenticator enrolment.
Executives act on a sentence containing a number and a mechanism. They ignore 'MFA is now enforced', which describes a control, not the risk that remains.
3. Which single detection would most have shortened the nine-day dwell time, and what would you measure monthly to show it keeps working?
Read the worked answer
Detection: an alert on new authenticator enrolment followed by a mailbox-rule creation by the same identity within a short window, plus impossible-travel/ASN change on the same account. That combination is the attacker's actual footprint here, and it fires on night one rather than day nine. Mailbox-rule creation alone is noisy; sequencing it against enrolment gives a high-signal, low-volume rule.
Monthly measures that change behaviour:
- Median time from high-risk sign-in event to human acknowledgement (target under 30 minutes in business hours, under 4 hours out of hours). This measures response, not just tooling.
- Percentage of privileged or configuration changes reviewed within 24 hours.
- Count of new authenticator enrolments that were not preceded by a help-desk ticket - a direct measure of help-desk compromise.
Deliberately avoid reporting only phishing-simulation click rate. It rewards easy campaigns, punishes realism, and would not have detected anything in this incident. Report it if you like, but not as the headline metric that justifies the budget.