The incident | Catching an identity attack before it escalated
In November 2024, Five Nines faced a real-world challenge when a threat actor used stolen credentials to exploit an outdated Cisco AnyConnect VPN. Around 5:50am, Managed ITDR picked up suspicious activity—early signs of reconnaissance and lateral movement—on a client’s network. The Huntress AI-assisted Security Operations Center (SOC) quickly stepped in to stop the threat from spreading.
“Huntress did a full environment isolation,” says Kahle. “What could’ve been a ransomware attack ended up being a non-event.”
With the malicious hacker locked out, Five Nines moved fast to contain the threat, lock down the vulnerable VPN, and ensure it couldn’t be used as a foothold again. By 8:10am, client systems were restored, with only a few endpoints needing follow-up remediation.
Had this incident gone unresolved, it could’ve led to data exfiltration, extortion, or full-blown ransomware deployment. But thanks to Five Nines’ proactive planning, rapid response, and their partnership with Huntress, a potentially devastating breach became just another busy morning—and powerful proof for why clients trust them for their cybersecurity needs.