The DLP alert: a customer list leaves the company
A salesperson who has just resigned uploads 12,480 customer records to a personal cloud account. How the data loss alert became an incident, an agent established the facts, a person approved containment, and HR and the data protection officer handled the rest within three hours.
Read the case
Blue screens everywhere: a faulty security update and a major incident
At 07:05 people open their laptops and get a blue screen. A faulty update from the endpoint security vendor has hit every Windows laptop that was on that morning. How six tickets became one major incident, the company stayed informed every 30 minutes, and all 19 laptops were back by 10:40.
The contract nobody owned: renewing firewall support in time
Support for the core firewalls was 44 days from its end, auto-renew was off, and the owner had left in June. How a daily check found it, the records showed what the contract was worth, and the team renewed it twelve days before the notice deadline.
The log that ate the disk: a PostgreSQL emergency at 3 a.m.
At 02:47 the billing database is 45 minutes from a full disk. The cause: 131 GB of write-ahead log that hasn't been archived for four days, since a key rotation missed the archiver. How the night shift avoided the outage without touching a single log file by hand, and how the morning closed the gaps.
Shipped at five, broken by eight: rolling back a bad release
An evening release looks healthy for almost three hours, then card payments start failing. How the change record pointed at the cause, an agent found it in the logs, a person chose to roll back, and the fix shipped the next morning in office hours.
Three critical CVEs in one week: PHP2Shell and CVE-2026-98432
Two PHP flaws that allow code execution without logging in, then a Linux kernel TCP flaw the week after. How a team of people and AI agents found every exposed host, patched the internet-facing ones first and kept the rest under control.