Samples · fictional client
Three incident engagements for a fictional client. Every report as delivered, grouped by engagement and by stage or week.
Who they are
Wrenfield Bancorp, Inc. is the holding company of Wrenfield Bank in Syracuse, New York: 61 branches across central and western New York, $7.4 billion in assets, and 1,240 employees. Core banking runs at a vendor’s service bureau; since 2021 AWS has run its loan origination platform, document imaging archive, data lake, digital account-opening and online-banking middleware, and treasury management portal. It is the fictional client for the three incident engagements.
wrenfield-0-guide.pdf
Who Wrenfield is, what happened over the Fourth of July weekend, what each of the 22 reports delivers, who may read it, and what is real and what is simulated.
View Sample Engagement Reports in the PDF viewerDownload PDF of Sample Engagement Reports
vantalect-wrenfield-sample-reports.zip
Every PDF from the Wrenfield Bancorp, Inc. engagements (AWS Incident Response, AWS Breach Forensics & Recovery and AWS Incident Response Retainer), the reading guide included, as delivered, in one download.
Download ZIP of the Wrenfield Bancorp, Inc. sample reportsAWS incident response · containment · evidence
A fictional regional bank, on a holiday weekend, with a ransom note in its loan documents bucket and an attacker who had rewritten 61.3 million of its 286 million imaging objects under keys set to expire: contained in six days, nothing paid to the attacker, and no object the bank needed under the attacker’s keys when they expired.
Download all 23 Wrenfield PDFs as one ZIP
The sponsor readout is the short document an executive reads and signs off on. The full reports below are for the engineers it gets forwarded to.
wrenfield-ir-3-brief.pdf
One page the CEO and board can read once counsel forwards it: what happened, what is protected, what is still unknown, and what decisions are theirs.
View Executive Brief at Containment in the PDF viewerDownload PDF of Executive Brief at Containment
Days 1 to 6: the fixed rhythm
wrenfield-ir-1-sitreps.pdf
What was known, what was being done, and what came next, report by report on the fixed rhythm, for the bank’s incident team; legal items go to counsel in the clock worksheet.
View Operational Situation Reports in the PDF viewerDownload PDF of Operational Situation Reports
Days 1 to 6: Contain
wrenfield-ir-2-containment.pdf
Every action taken, who approved it, what it changed, what was preserved first, and how to undo it.
View Containment and Eradication Actions in the PDF viewerDownload PDF of Containment and Eradication Actions
Day 6: Interim worksheets
wrenfield-ir-4-clocks.pdf
The deadlines that may run from the client’s own determinations, computed from the times the client entered, with the facts each needs.
View Notification-Clock Worksheets (Interim) in the PDF viewerDownload PDF of Notification-Clock Worksheets (Interim)
Day 6: Evidence at containment
wrenfield-ir-5-custody.pdf
Every evidence item from collection to storage, hashed, so counsel can authenticate it.
View Chain-of-Custody Log (at Containment) in the PDF viewerDownload PDF of Chain-of-Custody Log (at Containment)
AWS forensics · CloudTrail · recovery
A fictional regional bank, a week after the ransom note: how the attacker got in, what they touched, whether they are out, and the six root causes (3 of 3 critical closed as code, 1 accepted in writing), with half of the $50,000 Recovery fee riding on a closure sweep.
Download all 23 Wrenfield PDFs as one ZIP
The sponsor readout is the short document an executive reads and signs off on. The full reports below are for the engineers it gets forwarded to.
wrenfield-forensics-3-brief.pdf
The Investigation’s answer for the board: how they got in, what they touched, whether they are out, and what closes the door.
View Executive Brief in the PDF viewerDownload PDF of Executive Brief
Week 1 of 4: Preserve and map
wrenfield-forensics-1-estate.pdf
The organization as it stood, every log source and its gaps, and what was preserved, so every later claim has a source.
View Estate Map and Evidence Preservation in the PDF viewerDownload PDF of Estate Map and Evidence Preservation
Week 2 of 4: Trace
wrenfield-forensics-2-narrative.pdf
What the attacker did, in order, minute by minute, from first access to the last attempt, with each step’s evidence.
View Attack Narrative and Timeline in the PDF viewerDownload PDF of Attack Narrative and Timeline
Week 2 of 4: Trace (appendix)
wrenfield-forensics-2-appendix.pdf
Every indicator in one table and in machine-readable form, for the client’s detections, its peers, and law enforcement, once counsel clears it.
View Indicators of Compromise in the PDF viewerDownload PDF of Indicators of Compromise
Week 2 of 4: Trace
wrenfield-forensics-4-inventory.pdf
Every principal, credential, resource, and data set the attacker used, created, changed, read, or copied, with confidence.
View Compromise Inventory in the PDF viewerDownload PDF of Compromise Inventory
Week 2 of 4: Trace
wrenfield-forensics-5-root-cause.pdf
Why the attack worked at each step, and what else in the estate would have let it work; an operational appendix holds the control gaps and the fix plan.
View Root Cause and Vulnerable Infrastructure in the PDF viewerDownload PDF of Root Cause and Vulnerable Infrastructure
Week 2 of 4: Trace
wrenfield-forensics-6-legal-memo.pdf
The facts counsel needs, organized by the regimes counsel may want to consider; a draft for counsel, not legal advice.
View Legal and Regulatory Considerations: Draft for Counsel in the PDF viewerDownload PDF of Legal and Regulatory Considerations: Draft for Counsel
Week 2 of 4: Trace
wrenfield-forensics-7-clocks.pdf
The interim worksheets brought up to the Investigation’s facts.
View Notification-Clock Worksheets in the PDF viewerDownload PDF of Notification-Clock Worksheets
Week 3 of 4: Eradicate and close
wrenfield-forensics-8-eradication.pdf
Every inventory item removed or isolated and every critical root cause fixed as code, with its pull request.
View Eradication and Root-Cause Closure in the PDF viewerDownload PDF of Eradication and Root-Cause Closure
Week 4 of 4: Closure sweep and hand over
wrenfield-forensics-9-closure-sweep.pdf
The gate: week one against week four, the same method, and seven days of watch.
View Closure Sweep in the PDF viewerDownload PDF of Closure Sweep
Week 4 of 4: Hand over
wrenfield-forensics-10-factual-summary.pdf
Facts only, no analysis or opinion, for counsel to release.
View Factual Summary for Regulators, Insurers, and Auditors in the PDF viewerDownload PDF of Factual Summary for Regulators, Insurers, and Auditors
Week 4 of 4: Hand over
wrenfield-forensics-11-custody.pdf
The full custody record at the close, with the destruction certificate for Vantalect’s working copies.
View Chain-of-Custody Log (Final) in the PDF viewerDownload PDF of Chain-of-Custody Log (Final)
AWS incident readiness · one year · prepaid hours
A fictional regional bank that bought the Retainer once its Recovery closed: the access role drilled in 9 minutes, the logs checked against the attacks that matter, a readiness readout, and a tabletop on a different attack, with 40 of 40 prepaid hours untouched.
Download all 23 Wrenfield PDFs as one ZIP
The sponsor readout is the short document an executive reads and signs off on. The full reports below are for the engineers it gets forwarded to.
wrenfield-retainer-3-readout.pdf
What the client is ready for now, what is still exposed, and the commitments in force.
View Readiness Readout in the PDF viewerDownload PDF of Readiness Readout
Week 1 of the Retainer: Access
wrenfield-retainer-1-access.pdf
The role deployed, the drill run, and the measured minutes from activation to first read.
View Activation Role and Drill in the PDF viewerDownload PDF of Activation Role and Drill
Week 2 of the Retainer: Log readiness
wrenfield-retainer-2-log-readiness.pdf
Whether the evidence the next investigation needs will exist, and what each gap costs to close.
View Log-Readiness Check in the PDF viewerDownload PDF of Log-Readiness Check
Month 2 of the Retainer: Tabletop
wrenfield-retainer-4-tabletop.pdf
What the team did with a realistic scenario, where it slowed down, and what changes.
View Tabletop Exercise After-Action Report in the PDF viewerDownload PDF of Tabletop Exercise After-Action Report
Week 1 of the Retainer: Call sheet
wrenfield-retainer-5-call-sheet.pdf
Who calls whom, in what order, with which numbers and documents, at 1 AM on a holiday.
View Activation Call Sheet in the PDF viewerDownload PDF of Activation Call Sheet
The next conversation
Tell Charles which challenge is in front of you. He will tell you which engagement fits and what it would measure.
Remote engagements nationwide.
Serving clients since 2020.