What ARRAC looks like
in production.
Anonymised incidents from real Microsoft 365 environments. These are the threats ARRAC is designed to handle — and what happens when it does. No staged demos. No hypothetical scenarios.
Session token theft stopped.
Law firm, 47 users.
A senior partner's credentials were compromised via an Adversary-in-the-Middle phishing attack. The attacker obtained a valid session token despite MFA being enabled — a technique that bypasses traditional authentication entirely by intercepting the session cookie after a successful MFA challenge.
Within seconds of the attacker's first action (creating inbox forwarding rules to exfiltrate client communications), ARRAC correlated the anomalous sign-in pattern — new device fingerprint, unusual geolocation, immediate inbox rule creation — and revoked the session.
The attacker possessed the stolen token for 23 minutes before their first action triggered ARRAC's detection. From detection to containment: 4 seconds. Zero files accessed, zero emails forwarded. The inbox rules were created but never executed — revoked before the first forwarding event fired.
Malicious app grant revoked.
Accountancy firm, 31 users.
A junior staff member received a phishing email impersonating a known document signing service. Clicking through presented a legitimate-looking Microsoft consent page, requesting Mail.ReadWrite and Files.ReadWrite.All permissions — effectively granting a third party persistent read/write access to every email and file in the tenant.
ARRAC detected the OAuth consent event in real time, identified the unverified publisher, assessed the scope risk as critical, and revoked the grant within 3 seconds — before the malicious application could make a single API call to read or exfiltrate data.
Without ARRAC, this would have been a silent, persistent breach — continuous read/write access to all 31 users' email and files until the grant was manually discovered, potentially weeks or months later.
Lateral movement stopped
at 2:17am. Logistics, 94 users.
An attacker compromised a standard user account through credential stuffing — the user had reused a password exposed in a third-party breach. At 2:17am on a Tuesday, the attacker began the reconnaissance phase of a ransomware deployment: querying Active Directory group memberships, attempting to identify privileged accounts, and probing for Global Admin credentials.
This is the pre-deployment pattern common to most modern ransomware attacks — an attacker establishes a foothold with low-privilege access, then elevates before deploying the payload. ARRAC recognised the pattern (MITRE T1078, T1484) and isolated the account at 2:17am — before anyone was awake to see the alert.
The on-call engineer received an automated notification at 2:18am. By the time they reviewed the incident at 7:30am, the attacker had been locked out for over 5 hours. Zero systems were encrypted. The company's cyber insurance provider accepted ARRAC's immutable audit log as evidence of containment.
Dormant Global Admin found.
MSP managing 8 client tenants.
An MSP using ARRAC across 8 client tenants. A member of staff at one of those clients left the organisation. The client's IT team followed their normal offboarding process — disabling the Microsoft 365 account, revoking email access, and removing licences. What they missed: the account was still assigned the Global Administrator role in Entra ID.
For 6 days, a former employee retained full administrative access to the entire tenant — every user, every setting, every piece of data — with credentials that were no longer under the organisation's control. ARRAC's daily identity audit flagged the dormant privileged account and surfaced it to the MSP console as a high-severity finding.
The MSP remediated within an hour of notification. No breach occurred, but the 6-day exposure window represented real, measurable risk — the kind that manual IT processes routinely miss and that cyber insurers increasingly ask about.
All case studies are anonymised. Sector, organisation size, and timing details are accurate; identifying information has been removed. Timings represent real system events as recorded in ARRAC's immutable audit log. Individual results will vary depending on environment configuration, autonomy tier settings, and the nature of the incident. Platform-wide, ARRAC benchmarks ≤30 seconds containment for novel threats and ≤5 seconds for known threat patterns, with a measured average of 12.3 seconds across live tenants.
These threats exist in
your environment too.
Connect Microsoft 365 and ARRAC starts detecting in your real tenant — not a staged demo. See your actual posture score and any live threats within minutes.