Case studies (anonymized)

Summaries of real assessments and attacks. Names and identifying details are removed.

Active Directory risk assessment: 100 out of 100

A PingCastle assessment of a local nonprofit's Active Directory environment returned a risk score of 100 out of 100. The main issues: a KRBTGT account that had never been rotated (a Golden Ticket risk), too many privileged accounts, hundreds of stale user and computer objects, unsupported Windows systems, no LAPS, and gaps in logging.

Read the full case study

Password spray against a nonprofit executive

A nonprofit's Executive Director faced 1,159 sign-in attempts from 609 IP addresses within a few hours. Microsoft's defenses blocked 80.9% of them. The lessons: require multi-factor authentication, use conditional access, review sign-in logs, and enforce password hygiene.

Read the full analysis