Evidence
Client stories
Specific outcomes from security event analytics reviews and anomaly investigations — including one case where the first pass raised more questions than answers.
Security Event Analytics Review
“The review forced us to admit half our ‘security’ events were retry noise from a payment callback. Once those were tagged, the anomaly queue finally had room for auth spray patterns we had been missing.”
Min-jun Park · Application owner, fintech product team, Seoul
Anomaly Pattern Investigation
“We brought them a three-day spike in permission denials that looked like an attack. Their timeline showed a misconfigured partner batch job after a certificate rotation. I wished we had checked change tickets first — but the write-up still saved a weekend of panic paging.”
Hye-rin Choi · Security operations lead, logistics platform
Detection Rule Tuning Workshop
“The workshop was blunt. Two of our prized rules were unusable after lunch. We left with fewer alerts and a short list of auth anomalies that actually deserve a page.”
David Okonkwo · Application security engineer, Busan
Extended story · Security Event Analytics Review
When coverage looked fine until silence was tested
A mid-size commerce team in Gyeongnam asked for a flagship review after an auditor asked how they would notice suppressed logging. Their dashboards showed steady authentication volume. Retention looked healthy.
During the sample window we asked a simple question: what happens when the nightly inventory sync fails to emit its completion event? Nobody had a detector for that silence. A controlled disable of a non-production logger confirmed the gap — the main charts still looked calm.
The findings report ranked missing-event detectors beside traditional spike rules, assigned owners on the platform team, and noted that PIPA-sensitive fields in auth events needed hashing before any future external share. Three months later the same team returned for a quarterly retainer to keep the silence checks honest through release seasons.
Extended story · Anomaly Pattern Investigation
Credential stuffing that hid inside mobile retries
An identity team noticed elevated login failures but blamed flaky mobile clients. The investigation reconstructed failures by client fingerprint and ASN. One fingerprint family showed success-after-failure streaks inconsistent with normal retry backoff.
We ranked that pattern above raw volume, recommended short-term rate limits on that fingerprint class, and listed which application events were still missing — notably MFA challenge outcomes. The reservation from their side was fair: without MFA event coverage, some takeover attempts would still blend into noise. That gap became the next review item rather than a claim of full visibility.