Case study
Six to twelve months inside. Gone in 48 hours.
The story of a campaign that lived behind a $500K-a-year security stack — and what happened in the first hours after Nodal CyberBrain switched on.
The setup
Every layer did its job. The campaign lived between the layers.
This resort had what a serious security budget buys: next-generation firewalls, endpoint detection and response, intrusion prevention, a zero-trust architecture, and 24/7 MSSP monitoring — over $500K a year, professionally run. None of it was broken. And an adversary still operated inside the network, undetected, for six to twelve months — because every tool watched its own layer, and the campaign was the pattern between them.
What it saw
Hours, not months.
Within hours of passive deployment, Nodal CyberBrain assembled the campaign into a single Ticket: the compromised devices, the relay structure, and the command-and-control paths leading out of the network — the full chain, mapped, from traffic the stack had been carrying all along.
The resolution
48 hours to remediation. Zero business impact.
With the complete chain in hand, the response was surgical: full remediation within 48 hours, and not one minute of guest-facing downtime.
Validated by Greg Akers — former SVP of Security Research at Cisco.
$500K+
Annual security spend already in place
6–12months
Undetected inside the network, without CyberBrain
48h
To full remediation once CyberBrain was deployed
$0
Guest-facing business impact
The full write-up
What the stack saw, what it missed, and the first hours after deployment.
The complete account, including the chain as it was reconstructed and what the remediation sequence actually looked like.
What generalises
Three things this case is actually about.
One resort is an anecdote. These are the parts that hold whatever your network looks like.
Spend was never the variable
Half a million dollars a year of well-chosen tooling, correctly configured and professionally monitored, did not close this gap — because none of it was the wrong product. The gap was structural: nothing in the stack was looking at the relationships between devices.
The evidence was already on the wire
Nothing new had to be collected. The coordination pattern was present in traffic the network had been carrying the whole time; it took a system built to look for coordination rather than for signatures or anomalies to resolve it into a campaign.
Speed came from completeness
Remediation took 48 hours because the chain arrived mapped. The expensive part of an incident is usually reconstruction — deciding which of forty-seven alerts belong to the same operation, and which machines are still in it.
We view and use the Nodal Technologies CyberBrain as the last line of defense in our arsenal. It catches that which others do not. Including that which our employees miss or in fact cause. It is our secret weapon against cyber adversaries.
Could you disprove this in your network?
The uncomfortable part of this story isn't that it happened. It's that until deployment day, this resort's dashboards looked exactly like yours do right now. There's one way to know.
First time here?What we mean by a campaign
A campaign is a coordinated, multi-stage adversary operation conducted across devices over time — reconnaissance, lateral movement, staging, and command-and-control working together toward an objective. Your existing tools report the isolated events. The campaign is what those events add up to — and it's what most stacks never see.
See it work
See the same insights on your own network.
Thirty minutes with a Nodal engineer. Passive deployment, no agents, and an evidence-based answer to the question this page is really asking.