Anatomy of an Attack
A 38-seat SMB, somewhere in Québec. On a winter Sunday night, the same booby-trapped email lands in two versions of the same company: on the left, nothing protects it; on the right, the infrastructure is managed by SRG. Watch the night unfold — live, side by side.
Fictional scenario, inspired by publicly documented incidents. No named company is involved.
10:14 PMAn email like any other
An “overdue invoice,” an urgent tone, a credible logo. On both sides, the same tired employee opens the same attachment on his laptop. For now, nothing tells the two nights apart.
10:15 PMThe first minute decides everything
On the left, the code runs silently — no managed antivirus, no behavioral detection: the machine already belongs to someone else. On the right, the detection agent recognizes the behavior and blocks execution. The workstation is flagged suspect.
10:31 PMWhile nobody is watching
On the left, the workstation calls the attackers’ server and awaits orders; the firewall is eight years old and nobody reads its logs. On the right, the machine is already cut off from the network — and SRG’s on-call technician is looking at the alert, two minutes after the click.
11:02 PMThe spread — or not
On the left, an admin password reused everywhere opens doors one by one: the network is flat, nothing separates reception from payroll. On the right, the network is segmented and credentials are reset — no lateral movement.
11:47 PMThe backups
On the left, the attackers find the backup drive — permanently connected, visible on the network — and wipe it before encrypting anything. On the right, the backups are off-site and immutable: they were never reachable.
3:12 AMEncryption — and incident closed
On the left, 38 workstations and 2 servers encrypt their own files: quotes, contracts, payroll, 14 years of history — locked behind a key only the attackers hold. On the right, the incident has been closed since 10:41 PM: machine reimaged, report filed. 27 minutes.
7:58 AMMonday morning
On the left, the receptionist turns on her screen: “Your files have been encrypted.” The demand: $450,000 in cryptocurrency. Nobody knows who to call. On the right, the only trace of the night is an incident report — and a short anti-phishing training on the calendar.
The same night. $450,000 — or 27 minutes.
Weeks of downtime, lost clients, a mandatory Law 25 disclosure, sleepless nights — or a ticket closed before midnight. The difference isn’t luck: it’s a managed, monitored, segmented infrastructure.
Let’s talk about your IT. No cost, no jargon, no commitment.
A 30-minute conversation to understand your situation and tell you frankly what we would do — even if the answer is “nothing”.
or call us: 450 300-1902