Video2:404 November 2026
Stolen Password. CyberBrain correlates identity activity.
The password was correct. That was the whole problem. A stolen password. Two machines twenty-eight hundred miles apart, both logging in at 12:49 in the morning. Neither one looks like an emergency on its own.
Six years ago, malware scraped a credential off somebody's laptop. Then it got sold. Nobody rotated it. Nobody turned on multi-factor. It still works — and to the system it opens, whoever types it is the employee. At 12:49 AM EDT the same login lands from New York and from Oregon. On the New York machine it maps privilege, working out which roles exist, then mints itself an API key. Oregon is doing something else entirely: pulling data out. Reports. Customers. Invoices. Then both machines ship it to the same external host. Watched one box at a time, neither machine is worth waking anyone up for. So CyberBrain doesn't watch boxes. It gathers everything the identity did — across both of them — and opens a single case keyed to the identity rather than the device. Then it investigates, and returns a conclusion in plain English rather than a severity score: Confirmed Threat — Account Takeover with Active Data Exfiltration. One ticket reaches the analyst. Not four hundred alerts. And it already carries the recommended action, because everything traces back to one credential. That's the control point — and it's revoked through the API in one action, across both machines, at the same instant. The exports stop mid-transfer. Both sessions die. Everyone else correlates evidence of a compromise. Nodal reconstructs the control behind it — and shows you where to break it.
Read the transcript
A stolen password. Two machines twenty-eight hundred miles apart, both logging in at 12:49 in the morning. Neither one looks like an emergency on its own.
This is a 2:40 walkthrough of an identity attack and the response to it, shown inside Nodal CyberBrain.
Six years ago, malware scraped a credential off somebody's laptop. Then it got sold. Nobody rotated it. Nobody turned on multi-factor. It still works — and to the system it opens, whoever types it is the employee.
At 12:49 AM EDT the same login lands from New York and from Oregon. On the New York machine it maps privilege, working out which roles exist, then mints itself an API key. Oregon is doing something else entirely: pulling data out. Reports. Customers. Invoices. Then both machines ship it to the same external host.
Watched one box at a time, neither machine is worth waking anyone up for. So CyberBrain doesn't watch boxes. It gathers everything the identity did — across both of them — and opens a single case keyed to the identity rather than the device.
Then it investigates, and returns a conclusion in plain English rather than a severity score: Confirmed Threat — Account Takeover with Active Data Exfiltration.
One ticket reaches the analyst. Not four hundred alerts. And it already carries the recommended action, because everything traces back to one credential. That's the control point — and it's revoked through the API in one action, across both machines, at the same instant. The exports stop mid-transfer. Both sessions die.
Everyone else correlates evidence of a compromise. Nodal reconstructs the control behind it — and shows you where to break it.
CHAPTERS 0:00 The pattern 0:05 The credential — stolen, sold, never rotated 0:21 Impossible travel: New York and Oregon, the same instant 0:34 What each machine did 0:54 The blind spot 1:07 One case, keyed to the identity 1:20 The conclusion, in plain English 1:40 What reaches the analyst 1:49 The point of control 2:08 Cut off mid-transfer 2:20 Resolved 2:29 Reconstruct the control
ABOUT THE SCENARIO Grounded in a 2024 credential-theft campaign documented by Mandiant / Google Cloud Threat Intelligence, in which roughly 165 organizations were exposed and 79.7% of the affected accounts had already been leaked by earlier infostealer activity. It is used here as an attack pattern. No customer, victim organisation or third-party platform is identified.
The environment, the identity, the devices and all data shown on screen are synthetic. This is a demonstration in a lab instance — not a recording of a real incident.
