A financial services firm
A 30 person financial services firm came to us knowing something was off, but not sure how exposed they really were. They handle sensitive client records every day, yet their sign in security had grown by accident rather than by design. Multi factor was enforced for part of the team and quietly skipped for the rest. No Conditional Access at all, so a valid password from anywhere on any device got in. Several accounts carried far more admin than the work actually required. Accounts from finished projects and former partners could still reach company data. The owner put it plainly. They knew enough to be worried, but not enough to fix it. In their industry a single bad sign in is the kind of scare that gets handled the week after rather than the week before. Our job was to handle it the week before.