Following two acquisitions, a logistics group engaged Derivee to run a red team simulation testing whether their detection and response could catch a realistic intrusion attempt.
During the engagement, testers identified a network trust relationship connecting the two acquired companies’ environments — a leftover integration that had never been documented or reviewed by either security team.
The finding prompted an internal audit of every legacy integration from both acquisitions, well beyond the original scope of the exercise.