After the same account was phished twice in a year, a small consulting firm stopped trusting passwords alone
A boutique consulting firm that hosts its own client-facing software platform.
The problem
A boutique consulting firm that hosts its own client-facing software platform kept getting burned by account takeovers. Within a year a user account was phished, the firm's cloud tenant was compromised, and the same account was phished again. Legacy infrastructure from a former IT provider added exposure. With no internal IT staff, the firm depended on outside help for everything, and passwords plus MFA were clearly no longer enough.
Why it mattered
The platform holds sensitive client data, and each compromise meant emergency response, awkward client conversations and reactive spending instead of planned improvement.
What we did
Rather than another round of password resets, Vizius proposed making the device part of the login decision: manage corporate and personal devices, then allow only compliant, registered devices to reach company resources. It folded ongoing cloud and identity maintenance into one predictable monthly service, wrote a mobile device management policy so the firm could enforce the change, and slated legacy systems for decommissioning.
What changed
A mobile device management policy and the device-management and conditional-access deployment were delivered under a renewed cloud maintenance arrangement.
- Legal and professional services
- Small company