Mudals Talk to an engineer

Case files

The work, with the numbers left in.

Clients stay anonymous; the engineering doesn’t. Each file shows the problem, what we built, and what changed.

Cybersecurity · Akamai

Protecting a financial institution from a supply chain attack.

Industry
Financial services
Practice
Akamai Managed Security
Scope
Login, OTP, loan and card applications, payment and profile APIs
Response
Contained in hours

What happened

An analytics provider the bank trusted was breached. A malicious JavaScript update reached the loan application portal through that integration and began capturing what customers typed into loan and card applications. Stolen session data then fuelled automated logins and API abuse, while high-volume traffic added pressure.

What we did

  • Investigated WAF events across applications and APIs, and hardened high-value banking endpoints with granular exceptions instead of disabling protection.
  • Tuned DoS protection and rate control for login, OTP, loan, card and payment services, reducing reliance on static IP blocking.
  • Correlated scanners, scrapers and anonymizers with attack behaviour so high-risk sources were challenged or denied.
  • Added confirmed attacker infrastructure to centralized network lists for rapid containment.
  • Used Bot Manager and Bot Manager Premier signals to stop credential stuffing and session replay, while approved automation kept running.

What changed

Hoursto contain, not days
6controls responding in parallel
0protections switched off to reduce noise

Replay

Step through the response, control by control.

Red is attack traffic, cyan is customers. Each control stops more of the attack at the edge without turning customers away.

Clock T+03:30 · attack traffic stopped at edge 97%
  1. 01Web Security AnalyticsCorrelate indicators across apps to scope impact→ Fast, accurate scoping
  2. 02WAFHarden login, loan, card and payment endpoints→ Exploitation blocked
  3. 03Rate ControlEndpoint thresholds with progressive enforcement→ Layer 7 DoS contained
  4. 04Client ReputationChallenge high-risk sources, keep real customers→ Bad sources filtered
  5. 05IP / Network ListsEmergency blocklists for attacker IPs and ASNs→ Low-risk containment
  6. 06Bot Manager PremierBlock automation attempting session replay→ Credential stuffing stopped

The timeline and percentages in this replay are illustrative of the sequence, not measurements from the incident.

Identity · IAM operations

Cutting IAM offboarding time by 85%.

Practice
Identity Security
Platforms
ServiceNow, Adaxes, Active Directory, Snowflake, CyberArk
Scope
About 25 downstream applications
Volume
~50 users per offboarding cycle, three cycles a week

The problem

Onboarding, offboarding and access changes were largely manual. Ticket volume kept growing, checks across about 25 applications were error-prone, and SLAs depended on individual effort. The ServiceNow team would not support the legacy integration, so a new path was needed.

What we did

  • Analyzed three years of ServiceNow tickets to find the top automation candidates: onboarding, offboarding and Snowflake access.
  • Built a PowerShell endpoint in Adaxes, triggered by ServiceNow business rules and REST messages, so new-hire tickets provision AD access with no manual steps.
  • Automated AD disablement and group removal on offboarding, with policy-aware manager reassignment for contractors and employees.
  • Gave teams an interim access-visibility tool for applications without a user-management API.
  • Extending the same model to Snowflake provisioning, service accounts and CyberArk credentials.

Offboarding time per cycle

Before~8 hrs
After~1–1.5 hrs
85%less offboarding time
Same dayclosure, from multi-day
0missed access removals since rollout

More from the field

Engineering results across the practices.

100%Tier-0 uptimeOn-premises to multi-AZ AWS with dedicated masters and private DNS.
ZeroManual Terraform draftingSelf-service infrastructure through Service Catalog, Lambda, GitHub and Atlantis.
70%Faster remediationGitHub Advanced Security and Copilot Autofix pull requests.
5 TBPer node, frozen tierExpanded from 2.5 TB across 16 Elasticsearch nodes, archive to Glacier.
10,000+Users cleaned upOkta Workflows removing stale access automatically.
< 1sCentral telemetryCross-account CloudWatch, VPC Flow and CloudTrail to SIEM.

Next step

Let’s build what’s next, securely.

Start with an Identity Security Assessment or a focused pilot in any practice, and judge our work first-hand.

Talk to an engineer → Take the 60-second readiness check