Engagement Example 1:

Post Incident Review (PIR)

Bastion was engaged to lead a Post Incident Review for a customer following a cyber event. Through staff interviews, document analysis, and process reviews, we identified root causes and gaps in response. Our findings led to 23 prioritised recommendations to strengthen the organisation's future incident handling and resilience.

• Interviewed 12 staff and vendors for a full-picture view
• Analysed incident data, roles, and response processes
• Delivered 23 clear, actionable recommendations

‍

Engagement Example 2:

CI/CD Pipeline Root Cause Analysis

Following a serious credential exposure incident, Bastion supported a customer with incident response and Root Cause Analysis. We worked with stakeholders to identify missteps, restore services securely, and implement remediation steps to prevent recurrence.

• Identified root cause of credential exposure in deployment
• Supported secure rollback and redeployment of services
• Advised on remediation and future prevention measures

‍

Engagement Example 3:

Account Enumeration

An organisation detected Account Enumeration Reconnaissance via Microsoft Defender for Identity. Bastion supported the investigation, coordinated with external providers, and helped implement containment and monitoring improvements.

• Deployed CrowdStrike Falcon with CTI for enhanced visibility
• Investigated log discrepancies and clarified rollover behaviour
• Identified firewall misconfigurations in MFN integration

‍

Engagement Example 4:

GCP Misconfiguration leads to exposes records

Bastion investigated a cloud data exposure incident affecting a SaaS provider. Misconfigured Google Cloud Bucket permissions led to 2.4 million files being publicly accessible and indexed by search engines.

• Identified public access misconfiguration in Google Cloud Bucket
• Recommended secure access controls and signed URLs
• Advised on logging, permissions, and regular security testing

‍

Engagement Example 5:

Employee Account Credential Leak via BYOD

Bastion investigated a security incident involving stolen Microsoft 365 session credentials from a personal device infected with malware. The organisation’s swift response and Bastion’s forensic analysis helped confirm no unauthorised access occurred.

• Analysed infected personal and corporate devices for credential theft
• Recovered browser data despite user attempts to clear history
• Recommended controls for device access and session security

‍

Engagement Example 6:

Breach of trust, restructure documents leaked

Bastion investigated a suspected data breach involving unauthorised access to a sensitive document. Forensic analysis uncovered system reinstalls, missing logs, and potential data concealment efforts, alongside evidence of intent.

• Analysed multiple devices and uncovered use of data deletion tools
• Identified missing logs due to lack of endpoint onboarding
• Found chat messages suggesting intent to access confidential data