Case Studies

Real incidents.
Real investigations.

See how security teams use Strand to investigate incidents faster, uncover what traditional tools miss, and generate the evidence that matters. All case studies are anonymised from real engagements.

Private equity, US and Europe

From Alert Triage to 100% Investigation Coverage

Proactive forensics across a private equity portfolio SOC

A private equity group operating an internal SOC for hundreds of portfolio companies used Strand to turn SentinelOne detections into automated forensic investigations, reducing cherry-picked triage and giving every alert a defensible answer.

1 dayto integrate with SentinelOne and start automated collection
1,600/weekendpoint alerts moved from triage queue into investigation coverage
Read case study
Manufacturing, UK

30 Minutes to Root Cause

Akira Ransomware via SonicWall VPN Compromise

A DFIR consultancy used Strand to identify the root cause of an Akira ransomware attack in 30 minutes, revealing a compromised SonicWall VPN account and persistence mechanisms including Cloudflared tunnels and AnyDesk.

30 minto identify root cause and all persistence mechanisms
4 hourstotal attack duration (access to encryption)
Read case study
Non-profit, UK

Tracing Six-Figure Fraud

Business Email Compromise at a National Charity

After £180,000 in grant funding was diverted to a fraudulent account, Strand identified PerfectData Software OAuth abuse that internal teams missed and generated evidence for regulatory notification within 24 hours.

25 minto complete M365 forensic analysis
40+ hoursof manual analysis automated
Read case study
Hospitality, UK

Protecting 400 Guests

ClickFix Social Engineering at a Regional Hotel Chain

When guests started receiving WhatsApp messages with their real booking details demanding payment, Strand traced the compromise to a Storm-1865 phishing campaign and identified persistence mechanisms the EDR had missed.

1 hourto analyse all 92 devices across 5 properties
412affected guests identified for notification
Read case study
Healthcare Services, UK

Finding Patient Zero

Qilin Ransomware via Helpdesk Social Engineering

When traditional forensics could not identify the entry point, Strand correlated helpdesk ticketing logs with Active Directory events to reveal a vishing attack that bypassed all technical controls.

3 hoursto collect and analyse 400 endpoints
1patient zero identified from 400 workstations
Read case study

Ready for your own investigation?

See how Strand can transform your incident response capabilities.

Book a demo