Real estate developer raises its protection grade from D to A- across three penetration tests
A regional commercial real estate developer. Outcome verified
D to A-
The problem
A regional commercial real estate developer expanding into fund management wanted to know how exposed it really was. Its IT was outsourced to a managed service provider, and leadership had no independent way to judge whether the environment would hold up against a criminal. The firm had no security staff to interpret findings or verify fixes.
Why it mattered
The firm moves large sums through vendor and client payments. A network compromise or email-based fraud could mean ransomware, lost funds and reputational harm with investors.
What we did
Vizius graded protection and detection separately, so the MSP's strong incident response was recognized while weak preventive controls were made plain, and tied each finding to a business consequence rather than a technical label. Recommendations avoided expensive technology. A follow-on retest checked only what had been fixed, and each later round added the newest attacker technique, most recently MFA-bypass phishing.
What changed
Protection graded D in 2022. A 2023 retest confirmed four of seven network findings resolved and high-priority findings cut from four to one. By 2025, prevention graded A-/B+, with one remaining high-priority exposure.
- Real estate and property
- Midsize company