customer 0 breached

Diagnostic checklist

• A targeted intrusion campaign ran unmitigated long enough to compromise this tenant — the Intrusion class leaked with no IDS/IPS in path.
• Diagnosis: rack an IDS/IPS on the edge (it shrinks Intrusion residual to zero) and a SIEM for earlier detection — the campaign warned before it landed.
• The breach is done, but trust and reputation take real time to recover; the incident stays open through the breach cooldown so you can review what got through.