Distributor rehearses a vendor-payment fraud attack and rewrites its first containment step the same day
A regional industrial distributor. Outcome verified
The problem
A regional industrial distributor's insurer asked whether it had run a cyber incident tabletop in the past two years. It had not, and its incident response guidance lived inside a disaster recovery plan rather than as something the team could run under pressure. The client wanted a plan and a live exercise within five weeks, from a team that had never rehearsed.
Why it mattered
Business email compromise and payment fraud are the most likely incidents for a company of this profile. Without a rehearsed plan the first real event would be improvised, with notification duties and wire recall windows at stake.
What we did
Vizius wrote a deliberately simple incident response plan, then built a scenario around the company's real exposures: an MFA bypass leading to a vendor bank-change fraud from a look-alike domain that passes email authentication. Facilitating in person, it scored the team on six dimensions and used the hot wash to change the plan on the spot.
What changed
The team scored 4.5 out of 5, the plan was revised the same day to make account suspension the first containment step for email compromise, and the client left with a short list of control fixes.
- Logistics and distribution
- Midsize company
- Cyber insurance requirements