page 1
Northwind
Logistics. 03:02.
Eleven facilities,
four thousand vehicles,
five people on the security team.
Tonight, one
of them is awake.
Four thousand alerts this week.
She will look at nine of them.
...HUH.
A backup account does not log
in at three in the morning.
page 2
The alert reached her ninety-four
seconds after the first signal.
Identity. Endpoint. Cloud storage.
Three systems that had
never spoken to each other.
Somewhere else, someone
was two hours into a job
they had budgeted four for.
DEV. IT'S MARA.
YOU'RE GOING
TO WANT TO BE
AWAKE FOR THIS.
I'M
AWAKE.
The encryption had
not started yet.
It was four
minutes away.
page 3
She did not have to find the pattern.
She had to decide what to do about it.
KILLING THE SESSION.
ROTATING THE KEY.
ISOLATING
THE HOST.
Nothing dramatic
happened.
First signal to contained:
nine minutes.
page 4
ANYTHING
LEFT FOR ME
TO DO?
PAPERWORK.
GO HOME,
MARA. I'LL
WRITE IT UP.
YOU'LL GET
THE TIMELINE
WRONG.
PROBABLY.
Northwind's security
team is five people.
Tonight, that
was enough.
71%
reduction in mean
time to respond
94%
fewer alerts requiring
manual review
94 seconds
first signal to analyst