Utility's office printer turns out to be the front door to domain administrator
A municipal wastewater utility. Outcome verified
The problem
A small municipal wastewater utility relied on an outside IT provider and had never had its defenses tested. A first, external-only test in 2024 found a public mapping portal exposing administrator credentials and a firewall open to a denial-of-service exploit. The utility wanted to know what an attacker inside the building could do.
Why it mattered
The utility runs critical public infrastructure and holds payroll and remote-access configurations on its file shares. A ransomware or fraud event would disrupt service and public trust.
What we did
Vizius scoped the second year as a combined external and internal test and followed the path a real intruder would take. A weakly configured office printer gave up a shared service account, which exposed a misconfigured certificate authority, and within days the testers held domain administrator rights. When the IT provider rotated credentials mid-test but missed its own admin account, the testers logged back in.
What changed
Two years of findings (five in 2024, seven in 2025, including two high) fed directly into a funded, milestone-based remediation program covering passwordless sign-in, policy-driven MFA, certificate-authority hardening and certificate-based Wi-Fi.
- Utilities and energy
- Small company