- Home
- Proof & results
What we delivered,
by sector and outcome.
Results from Mjolnir Security group engagements: MSOC production environments and incident response and forensics work. Client identities are withheld; named references are available on request.
Autonomous SOC,in real client environments.
SOC at enterprise scale
~31,000 employees and ~11 TB of security telemetry a day, roughly 120,000 raw alerts. MSOC reduced that to about 100 items a day that genuinely warranted attention, and baselined every identity from a year of history in under two hours.
Noise crushed, analysts freed
Tens of thousands of false alerts from benign cloud tooling, cut to near zero by severity governance and self-learning suppression.
Shadow remote access contained
An unauthorized remote-management agent and a malware incident were detected across the dealer fleet, contained, and endpoints safely reconnected.
A false alarm, correctly cleared
A suspected business-email compromise was investigated end to end and correctly cleared as a local send from an unlocked workstation.
Availability protected
Response guardrails prevented automated isolation of a domain controller and a perimeter firewall on noisy triggers, holding action until the signal was validated.
Exposed credentials caught early
Continuous credential-leak and infostealer monitoring surfaced breached credentials tied to live accounts before they were used.
Client identities withheld pending permission. Named references and logos available on request.
When it had already gone wrong.
Anonymized engagements from our DFIR practice.
Ransomware recovery
Ransomware encrypted patient-care systems at a Canadian healthcare organization. Our team contained the spread, recovered systems from secured backups and restored operations within 72 hours, without paying the ransom.
Ransomware at a remote, global operation
A B.C.-based transportation company called us in 2020 after a ransomware attack. Its first instinct had been to wipe everything, so little evidence survived, and remote operations around the world still ran on legacy equipment and dial-up connections. We investigated what remained and shipped replacement technology rather than rebuilding compromised systems. As reported in The Globe and Mail, February 2025.
Persistent intruder removed
A national financial institution found indicators of an intruder with more than six months of access. We identified every foothold and ran a coordinated remediation without disrupting trading.
Supply-chain breach mapped
A manufacturer was compromised through a trusted vendor's software update. We identified the vector, mapped lateral movement and led the coordinated response across business units.
Insider exfiltration proven
A critical-infrastructure operator suspected an insider was exfiltrating operational data. A covert forensic investigation identified the source and produced evidence that supported legal proceedings.
Point-of-sale compromise
Anomalous traffic from point-of-sale terminals across 40+ locations. We identified the malware, coordinated containment across every site at once, and limited data exposure.
Business email compromise traced
A provincial agency lost funds to a business-email-compromise scheme. We traced the attack chain, preserved evidence for law enforcement and hardened email authentication.
Client identities withheld pending permission. Named references and logos available on request.
Want a named reference?
We can connect you with a client in your sector, with their permission.