Real estate firm's zero-trust rebuild holds up under attack, but its building systems do not
A national real estate investment and development firm. Outcome verified
The problem
A national real estate firm had rebuilt its environment around cloud identity and a zero-trust network and was retiring legacy servers. Its security plan also described a regulated system boundary. Leadership wanted independent proof that an attacker with a foothold could not reach anything that mattered, and that the boundary held in practice.
Why it mattered
The firm holds investor, tenant and financial data, and the boundary carried contractual obligations. A failure would have been a compliance problem as well as a security one.
What we did
Vizius attacked from realistic starting points: a device plugged into an office, a nearby wireless attacker, and a stolen ordinary user account. It tested the specific claims in the security plan, then looked past the hardened core to the building systems that modernization projects usually skip.
What changed
Testers could not escalate privileges in the network or the cloud identity platform, which the report called very rare. The test did find cameras from a vendor barred for federal contractors, building systems on default credentials, and open shares holding third-party credentials.
- Real estate and property
- Midsize company
- NIST 800-171