Something happened. What actually helps?
Find the thing that happened to you below. For each one we show the capabilities that most specifically address the methods attackers actually used, taken from real cases rather than from a product category list.
Read the claim carefully, because it is narrower than it looks. We are telling you what was used against organisations this happened to. We are not telling you these would have stopped it, and we are not ranking anybody's products. If you are in the middle of an incident right now, this page is not the thing you need; call your incident responder.
How this list is built
We take the attacker methods recorded in real cases of each kind of incident, drop the ones that show up in nearly every kind of incident because those cannot tell two situations apart, and then rank what is left by how specifically each capability addresses what remains.
- 13 kinds of incident in the list, 8 of which we can currently answer.
- 10 attacker methods set aside as too common to be telling.
- Three shown by default because fewer stops separating one situation from another, and the rest are always one click away.
Our files were encrypted, or someone is threatening to publish data they say they took from us.
Ransomware / extortion claim
Most specific to this:
- Google Backup
- Entra ID backup
- M365 backup
Everything else that addresses these same methods (13)
- WAF
- Network DR
- SASE/SSE
- MFA
- DLP
- Firewall
- End-user elevation
- Cloud DR
- SSO
- IEP (M365 email protection)
- Phishing simulation
- Training
- Gateway
These are ordered too. They are not worse, they are less specific to this particular kind of incident, which usually means they help with a great many things at once.
Based on 46 mappings, which we have not yet checked back against the original cases.
Staff were sent convincing fake emails, and at least one person acted on one.
Phishing campaign
Most specific to this:
- Third-party
- Risk Management
- AI attack detection
Everything else that addresses these same methods (13)
- WAF
- Training
- Phishing simulation
- MFA
- SSO
- SASE/SSE
- DLP
- IEP (M365 email protection)
- Cloud DR
- Gateway
- Network DR
- Firewall
- End-user elevation
These are ordered too. They are not worse, they are less specific to this particular kind of incident, which usually means they help with a great many things at once.
Based on 49 mappings, which we checked and found partly right.
We were talked into paying a fraudulent invoice, or into changing the bank details we hold for a supplier.
BEC / payment fraud
Most specific to this:
- SSO
- MFA
- Gateway
Everything else that addresses these same methods (2)
- IEP (M365 email protection)
- DLP
These are ordered too. They are not worse, they are less specific to this particular kind of incident, which usually means they help with a great many things at once.
Based on 4 mappings, all 4 of which we checked back against the original cases.
Someone got hold of staff usernames and passwords and signed in as them.
Credential theft
Most specific to this:
- SASE/SSE
- MFA
- Network DR
Everything else that addresses these same methods (14)
- Firewall
- Google Backup
- Entra ID backup
- AI attack detection
- M365 backup
- WAF
- SSO
- End-user elevation
- Cloud DR
- IEP (M365 email protection)
- Phishing simulation
- Training
- DLP
- Gateway
These are ordered too. They are not worse, they are less specific to this particular kind of incident, which usually means they help with a great many things at once.
Based on 60 mappings, all 60 of which we checked back against the original cases.
Someone attacked a known weakness in software we run, often within days of it becoming public.
Exploit campaign
Most specific to this:
- Third-party
- SASE/SSE
- Network DR
Everything else that addresses these same methods (15)
- Firewall
- Risk Management
- Google Backup
- Entra ID backup
- M365 backup
- Cloud DR
- MFA
- End-user elevation
- AI attack detection
- DLP
- Phishing simulation
- Training
- SSO
- Gateway
- IEP (M365 email protection)
These are ordered too. They are not worse, they are less specific to this particular kind of incident, which usually means they help with a great many things at once.
Based on 93 mappings, which we have not yet checked back against the original cases.
We were reached through a supplier, an IT provider, or software we installed ourselves.
Supply-chain compromise
Most specific to this:
- Third-party
- SASE/SSE
- Firewall
Everything else that addresses these same methods (10)
- Network DR
- End-user elevation
- Cloud DR
- Risk Management
- MFA
- Gateway
- IEP (M365 email protection)
- Phishing simulation
- Training
- DLP
These are ordered too. They are not worse, they are less specific to this particular kind of incident, which usually means they help with a great many things at once.
Based on 48 mappings, which we have not yet checked back against the original cases.
Data of ours was left reachable from the internet by mistake, in a storage bucket, database or shared folder.
Data exposure / misconfiguration
Most specific to this:
- Third-party
- Risk Management
- Cloud DR
Everything else that addresses these same methods (6)
- SASE/SSE
- End-user elevation
- Network DR
- Firewall
- Gateway
- IEP (M365 email protection)
These are ordered too. They are not worse, they are less specific to this particular kind of incident, which usually means they help with a great many things at once.
Based on 15 mappings, which we have not yet checked back against the original cases.
Someone who worked for us took or misused data they were allowed to see.
Insider misuse
Most specific to this:
- Firewall
- MFA
- Network DR
Everything else that addresses these same methods (6)
- SASE/SSE
- Phishing simulation
- Training
- Cloud DR
- DLP
- End-user elevation
These are ordered too. They are not worse, they are less specific to this particular kind of incident, which usually means they help with a great many things at once.
Based on 14 mappings, which we have not yet checked back against the original cases.
Someone phoned our help desk pretending to be an employee and talked them into a password or MFA reset.
Help-desk social engineering
We tested this one and it did not hold up
Every one of the 15 pieces of evidence we had for this was checked against the cases it came from, and none of it held up. We would rather show you nothing than show you a recommendation we already know failed its own test.
Our website, or our phone system, was flooded with traffic until it stopped answering.
DDoS attack
We cannot map this one yet
We have not been able to map this one. The cases we hold carry no technique identifiers, and a flood of traffic or calls has no real expression in the technique catalogue we rank against. That is a genuine gap in what we can say, not a judgement that the incident does not matter.
We have to notify a regulator, or customers, that a breach happened.
Breach disclosure filing
There is nothing here to rank
This is a legal obligation rather than an attack, so there is no attacker technique to rank offerings against. What triggered the filing will be one of the other entries here, and that is the one to look at.
Equipment on the plant floor, or the systems that control it, was interfered with.
OT/ICS manipulation or interference
Missing on our side, not in the world
We cannot answer this yet because of a gap on our side, not because the incident is unusual or hard to defend. Attacks on industrial control systems are catalogued in a separate technique matrix that we have not yet loaded, so there is nothing here to rank against. Nothing on this page should be read as a statement about OT risk.
Someone used our cloud account, servers or bandwidth for their own ends, such as mining cryptocurrency.
Resource theft
Being worked on now
Work on this one is under way. The incident type was missing from the working vocabulary until 23 August 2026 and is being classified now; it should answer here shortly.
Five of the thirteen cannot answer yet, and they cannot answer for four different reasons. We have written out which reason applies to each rather than leaving a blank space, because a blank space and a genuine gap look identical and mean very different things.