09/10/2026
🕵️♂️ **Agent Foskett’s Friday Cyber Briefing**
**Episode: “The Incident Was Closed. The Attacker Was Still Inside.”**
“Good news. The security incident has been resolved.”
That’s what the SOC dashboard said.
And technically, it was correct.
The incident was closed.
Unfortunately, nobody had told the attacker.
Agent Foskett noticed something unusual.
**Time to resolution: 14 seconds.**
“Fourteen seconds?” he muttered.
“I've had kettles take longer to investigate a teabag.”
A closer look revealed:
• Microsoft Sentinel had automatically closed the incident
• The automation rule was far too broad
• Nobody had reviewed the underlying alerts
• The suspicious account was still active
On paper, everything looked secure.
In reality, the investigation hadn't even started.
Agent Foskett opened the sign-in logs.
A successful sign-in from an unfamiliar location.
Then more suspicious activity.
The automation hadn't stopped the attacker.
It had simply removed the warning.
“Splendid,” Agent Foskett remarked.
“We've automated the paperwork. Shame about the security.”
The investigation was reopened, containment initiated, and the automation rule corrected.
**Closed doesn't mean secure.**
💡 **Cybersecurity lesson of the week:**
Security automation is powerful.
But poorly configured automation can create dangerous blind spots.
🔐 **This Friday’s takeaway:**
If you're using Microsoft Sentinel:
– Review automation rules regularly
– Check incident closure conditions
– Investigate high-risk alerts
– Verify threats are contained before closing incidents
Because attackers don't care whether your dashboard says *Resolved*.
They care whether anyone is still looking.
**Stay sharp out there.**
Agent Foskett 🕶️
Develop IT. Protect IT. GEMXIT.
GEMXIT PTY LTD | GEMXIT UK LTD
