Red team against a client portfolio portal

Wealth management

A wealth management firm wanted to know how its defences held against a patient, targeted adversary rather than a checklist. The objective was set narrowly: reach the client portfolio data, quietly, and show the path.

Red team & code review, Wealth management firm, severity CRITICAL, reported 2025

At a glance

• Challenge. Detection was tuned for noisy, generic attacks, and a permissive interior let a slow operator move from one foothold toward client portfolio data.
• Approach. We ran an adversary simulation under agreed rules of engagement, moving with existing credentials and admin tooling, then mapped detections with the defenders.
• Result. Detection was retuned for low-signal behaviour, admin access needs hardware-backed MFA, the interior was re-segmented, and we replayed the key steps.
• Impact. A patient attacker with a single foothold could have reached client portfolio data through existing credentials, with steps the defenders' tooling did not see.
• Classification. CWE-653 Improper Isolation or Compartmentalization, MITRE ATT&CK: T1078 Valid Accounts. Component: Internal network path to the client portfolio portal.

The challenge

The firm had invested in endpoint detection and a monitored perimeter, and against noisy, generic attacks that investment works. A targeted adversary does not bring noisy, generic attacks. The gap this exercise probed was not a missing product; it was the assumption that detection tuned for commodity attacks also covers a slow operator who blends into normal traffic and never touches the patterns the tooling is looking for.

Once a foothold exists, the interior of most networks is more permissive than the perimeter suggests. Credentials left on one machine reach another. A path from an ordinary user to a system administrator exists because the internal segmentation was designed for convenience and reviewed less often than the edge. None of this is exotic. It is the ordinary interior of a network that has spent its budget facing outward.

Our approach

The engagement ran as an adversary simulation with a defined objective and rules of engagement agreed in advance, so the exercise measured the firm’s resilience rather than improvising scope. We favoured legitimate tooling and existing access over anything that would announce itself, because the point was to test what the defenders would actually see.

• Establish a foothold through a realistic initial vector and confirm what, if anything, was detected
• Move through the interior using existing credentials and administrative tooling rather than custom code
• Reach the portfolio data along the shortest defensible path, and stop at demonstrated access
• Reconstruct, with the defenders afterward, which steps were visible and which were not

The value was not the access. It was the timeline: where detection fired, where it should have, and the exact distance between the two.

From finding to fix

1. Established a quiet foothold
2. Moved using existing credentials
3. Reached the client portfolio portal
4. Retuned detection, replayed the path

The outcome

Detection was retuned for the slow, low-signal behaviour the exercise used, hardware-backed multi-factor was required for administrative access, and the interior was re-segmented so a single foothold no longer reaches the portfolio layer. The engagement’s real deliverable was a defender’s map of what had been invisible.

We replayed the key steps after remediation to confirm they were now detected or blocked. Reported as CRITICAL in 2025. Retest included in the engagement.

Check your own system

• Pick one ordinary workstation and map which credentials it caches and which other systems those credentials can log in to.
• Require hardware-backed multi-factor authentication for every administrative login, including interactive sessions on servers.
• Test from inside an ordinary user segment whether any route reaches the systems that hold client data, rather than reading the network diagram.
• Replay slow lateral movement with legitimate admin tools in a controlled exercise and record which steps your detection actually alerts on.

Read more case studies, see Red Team & Code Review, or tell us about your system on the contact page.