Here’s the funny thing about a “routine” security test: nobody expects it to find anything. The firm in this story ordered theirs to satisfy an insurance questionnaire and a client contract. Two weeks later, we were holding a working login to a mailbox full of vendor payment details. Nobody had been hacked. That was the whole point.
| Client | Regional commercial real estate services firm (name withheld), about 70 employees across three offices. |
|---|---|
| Environment | Microsoft 365, cloud accounting and property management tools, and a hybrid workforce. |
| Why They Tested | Cyber insurance renewal questionnaire and an annual-testing clause in their largest client contract. |
| DCS Services | Threat and penetration testing, vulnerability assessment, remediation, and managed security monitoring. |
| Results | Five exposed accounts reduced to zero. MFA enabled on every account. No open critical or high-severity findings at retest. |
The Situation: A Firm That Thought It Was Covered
On paper, this firm was in decent shape. Antivirus on every laptop. A solid firewall. MFA “turned on.” One capable IT generalist handled day-to-day tech, and DCS supported them with managed IT.
So why test at all? Two reasons. Their cyber insurance renewal asked when they’d last had a penetration test, and their biggest client required one every year. Box-checking, in other words.
The constraints were real. Month-end close meant finance systems were off limits for part of the window. The budget was modest. Leadership wanted zero disruption. So, we scoped the work to the external attack surface and Microsoft 365 sign-ins, and scheduled it around the close.
The Test: Thinking Like the Other Side
Our Threat and Penetration Testing work starts where an attacker would. We pulled public information (the website’s team page, LinkedIn, the company’s email format) and built a list of likely usernames. A vulnerability assessment of the firm’s internet-facing systems ran alongside it.
The ground rules were simple: fully authorized, scheduled, and “stop at proof.” If we got in, we’d show it, not browse.
Then came the quiet part. Hammering one account with endless guesses sets off alarms, so we didn’t. We tried one plausible password per account, across every account, slowly. It’s called password spraying, and the patterns it favors are painfully human: a season plus a year, or the company name plus a number.
What We Found
Within days, three accounts opened. Then we checked staff addresses against public breach data and found two more accounts still using passwords exposed in unrelated breaches. That made five exposed accounts out of 70.
None of this is exotic. Verizon’s 2025 Data Breach Investigations Report lists credential abuse as the most common way into a breach, at 22%. And in the infostealer data Verizon studied, a typical user’s passwords were unique only about half the time.
The finding that mattered most was one of those first three. A shared operations mailbox had been exempted from MFA years earlier, a “temporary” fix for a scanner that nobody ever reversed. Legacy authentication was also still enabled across the tenant, which lets older protocols sidestep MFA entirely. S
That mailbox held years of vendor emails and payment instructions. We stopped at proof, as agreed. But this is exactly where a test ends and a real business email compromise begins. In total we logged nine findings, one critical and three high.
What We Did About It
We called the owner and the IT lead about the critical finding within 48 hours. No waiting on a polished report. Then we worked alongside their IT generalist and closed every critical and high finding in ten business days:
- Enforced MFA on every account, including a redesigned shared mailbox
- Blocked legacy authentication
- Turned on smart lockout and conditional access
- Added a banned-password list, moved to longer passphrases, and reset all five exposed accounts
- Rolled out a password manager and piloted passkeys for leadership and finance
- Sent sign-in alerts to our managed SOC, so spray patterns get flagged. That’s managed IT services security doing its job after the test ends
- Ran a 30-minute staff session built around the real patterns we’d found
The Results
| Measure | Before | After |
|---|---|---|
| Exposed accounts | 5 | 0 remaining |
| MFA coverage | 65 of 70 (93%) | 70 of 70 (100%) |
| Legacy authentication | Enabled | Blocked |
| Open critical and high findings | 4 | 0 at retest |
On retest, the same spraying approach hit the new lockout and was flagged to monitoring. The firm submitted its insurance questionnaire with a current test and documented fixes. We won’t pretend a test sets anyone’s premium, because the insurer decides that. What changed is that the firm finally knew where it stood.
We assumed ‘MFA is on’ meant MFA is on. The test showed us the difference, and we fixed it before anyone else could find it.
What Other SMBs Can Take From This
- Passwords are predictable at scale. Attackers don’t need to be clever. They need to be patient.
- Exceptions are where attackers live. One forgotten MFA exemption undid a lot of good work.
- A test is only worth what you fix afterward. The report was the starting line, not the finish.
- Find the gap before someone else does. That’s what SMB penetration testing is for.
One more thing. A penetration test shows what an attacker can actually do. A cybersecurity risk assessment shows where you stand overall. Most growing businesses benefit from both, and our Security Posture Assessment is a good first step.
Want to See What an Attacker Would See?
Our penetration testing services are built for SMBs: scoped to your size, scheduled around your calendar, and finished with a fix plan instead of a PDF that gathers dust.
Request a penetration test or call (800) 922-7994 to talk with a security expert.
About DCS
Data Collaboration Services (DCS) is a trusted cybersecurity partner for growing businesses that need real protection, not another checklist. We find the gaps attackers actually use through threat and penetration testing, risk and posture assessments, and cyber insurance readiness. Managed SOC and managed security keep watch after the test ends.
