Utility fixes a pen-test report by changing how everyone signs in
A municipal wastewater utility. Outcome verified
The problem
A penetration test had just shown a small municipal wastewater utility how a printer password could become full domain takeover through short passwords, single-factor VPN, a shared Wi-Fi key and a misconfigured certificate authority. Leadership had a findings list and an outside IT provider, but no one to redesign how people and devices proved identity.
Why it mattered
Field crews could not be disrupted, the cyber insurer kept flagging a legacy remote-access appliance, and the next attacker would walk the testers' path.
What we did
Instead of patching findings one by one, Vizius treated remediation as identity modernization. Passwordless Windows sign-in was switched on quietly for everyone so a fifteen-character password policy could roll out department by department without a help-desk flood. Per-user MFA gave way to policy-driven conditional access, and laptops now join Wi-Fi with machine certificates instead of a shared key.
What changed
The fifteen-character minimum was enforced for all users by March 2026 and verified six months later. Passwordless sign-in is on all laptops, MFA bypasses are gone, and roughly 300 machine certificates carry the fleet on certificate-based Wi-Fi; the legacy Wi-Fi network awaits cutover.
- Utilities and energy
- Small company
- Cyber insurance requirements