Executive Brief
wrenfield-forensics-3-brief.pdf
The Investigation’s answer for the board: how they got in, what they touched, whether they are out, and what closes the door.
View Executive Brief in the PDF viewerDownload PDF of Executive Brief
Sample case study · AWS breach forensics & recovery
How they got in.
What they touched.
Whether they are out.
Four weeks with Wrenfield Bancorp, Inc., a fictional bank, starting July 13, after its Response closed. The Investigation traced one stolen key to 31 compromised items and six root causes, and its readout on Friday, July 24 told the board how, what, and whether. The Recovery closed three critical root causes as code and ran a closure sweep: no indicator active in the final seven days, and the gate was met on Friday, August 7. The Recovery is $50,000, with half of it riding on that gate, less the $8,100 credit for Response hours. It shows the method, not a typical result.
Wrenfield Bancorp, Inc. is a fictional company: every account, bank employee, and figure on this page is simulated. The AWS services and controls are real.
31
Compromise inventory items, each with a confidence and a status
3 of 3
Critical root causes closed as code
13
Alerts in the seven-day closure watch, all acknowledged self-test canaries
104 of 110
Consultant hours used of the Recovery’s cap
A sample engagement
Wrenfield is fictional.
The work is not.
Wrenfield Bancorp, Inc. does not exist. We built it to show what an AWS breach investigation and recovery produce for a regional bank: $7.4 billion in assets, 61 branches, 1,240 employees, and twenty-two AWS accounts when the Recovery ended, simulated call by call. Then we ran the Investigation and the Recovery against it, week by week, and wrote the reports.
Wrenfield is fictional. Its people, customers, accounts, figures, and attacker are invented for this sample, and any resemblance to a real bank, company, person, or threat group is coincidental. The attacker’s addresses come from ranges reserved for documentation. The reports are the real deliverables, written the way we write them for a client, and they agree with each other because every figure comes from one deterministic scenario. We never cite a client’s breach, with or without the client’s name, so this is how we can show you every page. Nothing on this page is legal advice, and the reports make no legal determination.
The client
Wrenfield Bancorp, Inc.
- Business
- A bank holding company and its commercial bank, with 61 branches across central and western New York. Core banking runs at a vendor’s service bureau and is not in AWS
- People
- 1,240 employees, headquartered in Syracuse, New York
- AWS
- Loan origination, the document imaging archive, the data lake, digital account opening, and the treasury portal; twenty accounts in one organization when the attack began, twenty-two when the Recovery ended
- Sponsor
- Mireille Danvers, Chief Information Security Officer
- Counsel
- Diane Whitcombe, Partner, Tessaly & Brook LLP (outside counsel)
- Lead
- Imani Castell, Cloud Platform Lead
- Risk
- Anand Sethuraman, Chief Risk Officer
- Suspicious activity reports
- Colette Marsh, BSA/AML Officer
Contained is not the same
as understood.
The Response ended with the attacker locked out and the bank’s data intact, and with the questions a board asks next unanswered: how the attacker got in, what else they touched, whether they were still in, and what to tell regulators, the insurer, and the auditors. Diane Whitcombe signed the Recovery on Friday, July 10, and the first week began on July 13.
The bank had a clear priority: learn it all from the logs it held, in the order counsel needed it, with nothing said outside counsel’s direction. The question that mattered most was whether the records left the bank. The loan database snapshot the attacker shared with their own account held 412,317 applicants’ records, 389,904 of them in New York and 15,077 in Pennsylvania, and the reports state the answer with its confidence and say what would settle it. Whether anyone read the imaging archive is unknown, because reads were not logged.
- The engagement
- The Investigation and the Recovery: four weeks, July 13 to August 7, 2026. The Investigation is the first two weeks; the Recovery adds the fixes and the closure sweep. Retained through Diane Whitcombe under a three-party letter.
- The fee
- The Recovery lists at $50,000: half at signature, half only if the closure sweep meets the gate. 18 Response hours, at $450, were credited ($8,100), so the bank paid $41,900 in all.
- The hours
- Up to 110 consultant hours; the Recovery used 104.
- The access
- The incident role, deployed by the bank from a template it read first in each of the twenty accounts that existed when the attack began, and removed on the day the gate was met. The accounts added after the attack began never had the role. Changes in the Recovery went through the bank’s own pull requests and change windows.
- The rule for conclusions
- Every claim carries its source and a confidence: confirmed, probable, possible, or not observed, with the evidence. Probable and unknown are stated as such.
How it went
Four weeks, as the sponsor saw them.
The Investigation is the first two weeks and the Recovery is all four. Each week ended with reports, and the readout to counsel and the sponsor came on Friday, July 24. The sample’s reports are below; the factual summary is in the edition updated at the Recovery’s close, and the Investigation’s first edition is not part of the sample.
- Week 1July 13 to 17The Investigation
Preserve it, then map it.
The first week preserved the evidence and drew the map: the organization as it stood, the identities and trust paths, the keys, the data stores, the network exposure, and a table of every log source with its coverage, its retention, and its gaps. The map was run on July 14 as a list of 19 estate checks, and the same list is what the closure sweep ran again in week four.
The limits of the evidence were stated before any conclusion, including the one that mattered most: reads on the imaging archive were not logged, so the report could not say whether anyone read it.
Delivered July 17. The estate map and the evidence preservation record, with every claim after it traceable to a source.
- Week 2July 20 to 24The Investigation
How they got in, in order.
The narrative follows the stolen key from its first use, Monday, June 29, 03:14, through 4 days, 17 hours, 50 minutes of quiet use to the first write-capable production session, Friday, July 3, 21:04, and on to the last attempt. 37 deploy sessions, 519 attacker calls, and three keys of their own are in it, minute by minute, each step with its evidence. The compromise inventory lists 31 items, 28 of them confirmed.
The readout on Friday, July 24 gave the board the answer: six root causes, three of them critical, and what closes each. Counsel received a draft of the legal and regulatory considerations, organized by regime and marked as a draft for counsel, and clock worksheets computed from the times the bank had recorded.
Delivered July 24. The narrative, the indicators, the inventory, the root causes, the draft for counsel, the clock worksheets, and the executive brief.
- Executive Brief, in the reports below
- Attack Narrative and Timeline, in the reports below
- Indicators of Compromise, in the reports below
- Compromise Inventory, in the reports below
- Root Cause and Vulnerable Infrastructure, in the reports below
- Legal and Regulatory Considerations: Draft for Counsel, in the reports below
- Notification-Clock Worksheets, in the reports below
- Week 3July 27 to 31The Recovery
Close every critical cause as code.
Eradication and closure ran through nine root-cause pull requests, plus two more for other weaknesses, and six custom guardrail policies (four service control policies and two resource control policies), each tested in a staging organizational unit first (14 test cases). The first two critical causes, the stale key and the over-trusting deploy role, were closed on July 28 and the organization-level guardrails for key origin, snapshot sharing, lifecycle changes, and batch jobs on July 29.
One cause was accepted in writing instead of closed: the central backup vault stays in governance mode until December 18, 2026, because moving it to compliance mode cannot be undone and the bank wanted one quarter to confirm its retention periods. Mireille Danvers signed the acceptance on July 31 with compensating controls and a review date.
Delivered July 31. Every inventory item removed, isolated, or accepted, and every critical cause fixed with its pull request, reviewer, and date.
- Week 4August 3 to 7The Recovery
The same sweep, a week of watch, and the gate.
The closure sweep ran the week-one map again on August 5, check for check, and re-ran every indicator search. The watch had started on Friday, July 31 at 09:00: 14 indicators tracked for seven days. In this sample it saw 442 events in the window and raised 13 alerts, all 13 acknowledged as the bank’s own self-test and 0 unexplained, with 0 indicators active. It is a replay of the sample’s scenario, not a measurement of a live feed.
The gate was met on Friday, August 7 at 15:00. The incident role was then removed from all twenty accounts it had been deployed in (the accounts added later never had it), the final custody log was closed with a destruction certificate for Vantalect’s working copies, and a factual summary, facts only, went to counsel to release to regulators, insurers, and auditors.
Delivered August 7. The closure sweep, the factual summary, and the final chain-of-custody log.
The gate
3 of 3 critical causes closed.
Nothing active for seven days.
Half the Recovery fee rode on one sweep. It ran the week-one map and every indicator search again, the same way, and it scores the estate, not the effort. Each step from the first run to the last is in the closure report.
Critical root causes
3 opento3 closed as code
Each with its pull request, its reviewer, its date, and a check that it holds. The one cause accepted in writing is not among the critical ones.
Indicators active in the watch
14 trackedto0 active
14 indicators for seven days from Friday, July 31. The watch saw 442 events and 13 alerts, all of them the bank’s self-test, acknowledged as tests; none was unexplained.
Gate criteria
7 of 7
The checklist has one more line, the removal of Vantalect’s own access and the close of the custody log. It records the hand-off after the gate and is not a condition of it.
The Recovery’s gate
Half of the Recovery fee, $25,000 of $50,000, is invoiced only if the closure sweep meets the gate, and the gate has seven criteria; the last line of the checklist records the hand-off after the gate and is not one of them. The first reads: The three critical root causes (RC-1, RC-2, RC-3) are closed as code. The watch criterion reads: No indicator active in the final seven days. It was met on Friday, August 7, so the gate invoice of $25,000 went out on August 7. The signature invoice, $16,900, was the signature half less the $8,100 credit for 18 Response hours, so the bank paid $41,900 in all.
What it does not answer. The reports cannot say whether anyone read files in the imaging archive, because reads were not logged, and they cannot say what the attacker will do with any records that left. The reports compute elapsed times from the bank’s recorded triggers; counsel assesses applicability, promptness, filing content, and compliance. What is material and when a clock started are the bank’s and counsel’s decisions, and the sample says so on every page that touches them.
Want this gate on your own organization?
Book a call about the RecoveryThe clocks and the commitments
What ran from the bank’s own
determinations, and what it accepted.
The worksheets compute an outer time limit from the time the bank entered and show the elapsed time to the notice. They decide nothing, and they do not assess promptness: applicability, materiality, and the discovery date were the bank’s and counsel’s.
Recorded notices and illustrative outer time limits.
Five notices are recorded. Each outer limit is computed from the trigger the bank recorded, and the worksheet shows the rule, the limit, and the elapsed time.
- CL-1 · The bank and Diane Whitcombe
FDIC: 12 CFR 304.23.
36 hours from the trigger the bank recordedThe bank determined a notification incident occurred: Saturday, July 4, 10:00. The outer limit the rule computes is Sunday, July 5, 22:00.
The FDIC was notified. Saturday, July 4, 14:30, 31.5 hours before the computed outer limit.
- CL-2 · The bank and Diane Whitcombe
Federal Reserve: 12 CFR 225.300 to 225.303 (Subpart N).
36 hours from the trigger the bank recordedThe bank determined a notification incident occurred: Saturday, July 4, 10:00. The outer limit the rule computes is Sunday, July 5, 22:00.
The Federal Reserve was notified. Saturday, July 4, 14:45, 31.25 hours before the computed outer limit.
- CL-3 · The bank and Diane Whitcombe
NYDFS: 23 NYCRR 500.17(a).
72 hours from the trigger the bank recordedThe bank determined a cybersecurity incident occurred: Saturday, July 4, 10:00. The outer limit the rule computes is Tuesday, July 7, 10:00.
NYDFS was notified. Sunday, July 5, 11:15, 46.75 hours before the computed outer limit.
- CL-4 · The bank and Diane Whitcombe
SEC: Form 8-K, Item 1.05.
4 business days from the trigger the bank recordedThe registrant determined the incident material: July 14, 2026. The outer limit the rule computes is Monday, July 20.
Form 8-K filed. Friday, July 17, 3 days before the computed outer limit.
- CL-6 · The bank and Diane Whitcombe
New York breach notice: N.Y. Gen. Bus. Law 899-aa.
30 calendar days from the trigger the bank recordedThe discovery date counsel set: July 4, 2026. The outer limit the rule computes is Monday, August 3.
Consumer notices mailed. Wednesday, July 29, 5 days before the computed outer limit.
One cause accepted in writing.
Closing it would have been irreversible, so the bank chose to wait, in writing, with compensating controls.
- ACC-1 · Mireille Danvers
The central backup vault stays in governance mode.
December 18, 2026 the date it is accepted untilMoving the central vault to compliance mode is irreversible once its grace period ends, and the bank wants one quarter to confirm its retention periods first.
Review. Signed July 31, with a review on October 30.
Other regimes are listed in the worksheets as counsel’s to decide or not in force, and the draft memo for counsel names the facts each one needs. The bank’s own materiality determination, on July 14, is recorded as the bank’s call.
How the trail was read
The same tracker,
the same facts in every report.
The narrative, the session tree, and the indicators come from Pursuit, the tracker Vantalect ran the trail through. It stores CloudTrail records, follows a seed credential through every session and role it reaches, and runs a catalog of alert rules. In this sample it ran in replay on the scenario’s own records, which is why the timeline’s 1,089 rows and the attacker counts agree across the reports.
The closure watch used the same tracker. Its alerts were the bank’s own self-test, one canary action for each rule it could test, acknowledged as tests. Two rules, PU-14 and PU-15, were not tested: one needs the intruder’s own credentials, and the other needs a successful outside use of a followed key or role. A replay is described here, not demonstrated.
What the replay held
- 124,498CloudTrail records stored
- 1,089timeline rows reconstructed
- 48credentials followed
- 59alert groups raised
- 14indicators watched after the fixes
- 442events seen in the watch
One method, run twice.
The sweep ran the week-one map and every indicator search again exactly as the first time, so a difference is a change in the bank’s estate and not in the method.
A gate that can fail.
The watch counts any call by an attacker address or the attacker’s account, and any principal the Investigation had found. A single hit would have kept the gate closed and the second half of the fee uninvoiced.
The deliverables
The reports in this sample.
Thirteen PDFs and 297 pages. Start with the readout; the reading guide shows how the rest fit together. Each report names its distribution line on its cover: counsel only, operational for the bank’s teams, or releasable once counsel clears it. The Control Gaps and Fix Plan is the detachable appendix of the root-cause report in this sample. Each one is tagged for screen readers, and each says on its cover that Wrenfield is fictional.
Start with the readout (9 pages)
Written for the board, and the one to read if you read nothing else: how they got in, what they touched, whether they are out, and what closes the door.
- Week 2 of 4: ReadoutJuly 24, 2026
For the engineers on the approved team
The fixes as code with their pull requests and the guardrails attached. Operational: for the bank’s platform and security teams. Forward Operational reports within the approved team; counsel controls release of reports marked Counsel only. The root-cause report is counsel only; its Control Gaps and Fix Plan appendix is operational once counsel detaches it.
- Week 3 of 4: Eradicate and closeJuly 31, 2026
Eradication and Root-Cause Closure
wrenfield-forensics-8-eradication.pdfEvery inventory item removed or isolated and every critical root cause fixed as code, with its pull request.
View Eradication and Root-Cause Closure in the PDF viewerDownload PDF of Eradication and Root-Cause Closure
The rest, week by week
The reading guide first, which covers all three Wrenfield engagements, then what each week delivered, in order.
- Reading guide to the 22 reportsSeptember 15, 2026
Sample Engagement Reports
wrenfield-0-guide.pdfWho Wrenfield is, what happened over the Fourth of July weekend, what each of the 22 reports delivers, who may read it, and what is real and what is simulated.
View Sample Engagement Reports in the PDF viewerDownload PDF of Sample Engagement Reports
- Week 1 of 4: Preserve and mapJuly 17, 2026
Estate Map and Evidence Preservation
wrenfield-forensics-1-estate.pdfThe organization as it stood, every log source and its gaps, and what was preserved, so every later claim has a source.
View Estate Map and Evidence Preservation in the PDF viewerDownload PDF of Estate Map and Evidence Preservation
- Week 2 of 4: TraceJuly 24, 2026
Attack Narrative and Timeline
wrenfield-forensics-2-narrative.pdfWhat the attacker did, in order, minute by minute, from first access to the last attempt, with each step’s evidence.
View Attack Narrative and Timeline in the PDF viewerDownload PDF of Attack Narrative and Timeline
- Week 2 of 4: Trace (appendix)July 24, 2026
Indicators of Compromise
wrenfield-forensics-2-appendix.pdfEvery indicator in one table and in machine-readable form, for the client’s detections, its peers, and law enforcement, once counsel clears it.
View Indicators of Compromise in the PDF viewerDownload PDF of Indicators of Compromise
- Week 2 of 4: TraceJuly 24, 2026
Compromise Inventory
wrenfield-forensics-4-inventory.pdfEvery principal, credential, resource, and data set the attacker used, created, changed, read, or copied, with confidence.
View Compromise Inventory in the PDF viewerDownload PDF of Compromise Inventory
- Week 2 of 4: TraceJuly 24, 2026
Root Cause and Vulnerable Infrastructure
wrenfield-forensics-5-root-cause.pdfWhy the attack worked at each step, and what else in the estate would have let it work; an operational appendix holds the control gaps and the fix plan.
View Root Cause and Vulnerable Infrastructure in the PDF viewerDownload PDF of Root Cause and Vulnerable Infrastructure
- Week 2 of 4: TraceJuly 24, 2026
Legal and Regulatory Considerations: Draft for Counsel
wrenfield-forensics-6-legal-memo.pdfThe facts counsel needs, organized by the regimes counsel may want to consider; a draft for counsel, not legal advice.
View Legal and Regulatory Considerations: Draft for Counsel in the PDF viewerDownload PDF of Legal and Regulatory Considerations: Draft for Counsel
- Week 2 of 4: TraceJuly 24, 2026
Notification-Clock Worksheets
wrenfield-forensics-7-clocks.pdfThe interim worksheets brought up to the Investigation’s facts.
View Notification-Clock Worksheets in the PDF viewerDownload PDF of Notification-Clock Worksheets
- Week 4 of 4: Closure sweep and hand overAugust 7, 2026
Closure Sweep
wrenfield-forensics-9-closure-sweep.pdfThe gate: week one against week four, the same method, and seven days of watch.
View Closure Sweep in the PDF viewerDownload PDF of Closure Sweep
- Week 4 of 4: Hand overAugust 7, 2026
Factual Summary for Regulators, Insurers, and Auditors
wrenfield-forensics-10-factual-summary.pdfFacts only, no analysis or opinion, for counsel to release.
View Factual Summary for Regulators, Insurers, and Auditors in the PDF viewerDownload PDF of Factual Summary for Regulators, Insurers, and Auditors
- Week 4 of 4: Hand overAugust 7, 2026
Chain-of-Custody Log (Final)
wrenfield-forensics-11-custody.pdfThe full custody record at the close, with the destruction certificate for Vantalect’s working copies.
View Chain-of-Custody Log (Final) in the PDF viewerDownload PDF of Chain-of-Custody Log (Final)
A breach you can explain to your board.
The Investigation answers the questions. The Recovery closes the door and proves it with a sweep, and the Retainer makes the next response faster.
The engagement · the Investigation, $30,000; the Recovery, $50,000
AWS Breach Forensics & Recovery
How they got in, what they touched, whether they are out, and what closes the door, from the logs you hold, retained through your counsel. The Investigation is two weeks; the Recovery adds the fixes in four weeks, with half the fee riding on the closure sweep.
Read the engagement
Sample case study · the same client
Wrenfield: the Response, on a holiday weekend
A fictional regional bank, on a holiday weekend, with a ransom note in its loan documents bucket and an attacker who had rewritten 61.3 million of its 286 million imaging objects under keys set to expire: contained in six days, nothing paid to the attacker, and no object the bank needed under the attacker’s keys when they expired.
Read the case study
Sample case study · the same client
Wrenfield: the Retainer, readiness before the next one
A fictional regional bank that bought the Retainer once its Recovery closed: the access role drilled in 9 minutes, the logs checked against the attacks that matter, a readiness readout, and a tabletop on a different attack, with 40 of 40 prepaid hours untouched.
Read the case studyLet's define the result.
Tell Charles roughly what happened, who your outside counsel is, and what logs you hold. You will hear back within one business day, and the first call is fifteen minutes.
AWS, Amazon Web Services, and the AWS service names are trademarks of Amazon.com, Inc. or its affiliates. MITRE ATT&CK is a registered trademark of The MITRE Corporation. Vantalect is not affiliated with or endorsed by any of them. Wrenfield Bancorp, Inc., its personnel, its customers, and the attacker are fictional. Vantalect and Charles Sieg are the real provider and author, and the named vendors and products are real and do not endorse this sample.