By Joseph Caruso, Founder, CEO and CTO, Global Digital Forensics
Why Compromising One Financial Employee Beats Attacking the Firewall
Modern banks, wealth management firms, hedge funds and fintech platforms invest heavily in perimeter firewalls and encrypted customer portals. Knowing this, sophisticated financial threat actors focus their reconnaissance on the human operators who already sit inside the trust boundary: wire desk specialists, client onboarding associates, IT helpdesk technicians and software developers. By combining targeted LinkedIn reconnaissance with real time adversary in the middle phishing links or voice vishing calls impersonating internal IT support, attackers capture active employee session tokens and step directly inside the internal network.
Testing Employee Resilience and Internal Privilege Boundaries
Global Digital Forensics helps financial institutions validate both their human defenses and their internal technical choke points. Working with financial CISOs, internal auditors and compliance officers, our specialists conduct realistic, role specific social engineering assessments paired with assumed breach internal penetration testing and Active Directory privilege escalation audits. We demonstrate exactly how far a single compromised associate workstation can reach toward core banking databases, SWIFT or wire approval terminals and customer portfolio records, providing concrete architectural fixes to contain credential compromise.
Reading the Identity Record After a Session Token Is Stolen
A stolen session token leaves a different trail from a stolen password. The attacker never fails a sign in, never triggers a lockout and never answers a multi factor prompt, because the proxy relayed the real employee's answer. What the Entra sign in log records instead is a token being presented from a new IP address, often a hosting provider, with a device identifier the tenant has never seen and a user agent that does not match the employee's managed workstation. Microsoft publishes how long those logs survive on its data retention page, and the window is short enough that an export in the first days decides whether the question can be answered at all.
From that point the record branches. The unified audit log shows which mailboxes the token touched, which files were downloaded from SharePoint or OneDrive and whether a mail rule or an OAuth application consent was added to keep access alive after the token expires. Conditional access reports show which policies evaluated the session and why they allowed it. Core banking and wire platforms keep their own application logs, which rarely synchronize with the identity provider's clock, so we normalize everything to UTC before drawing a timeline. What this record can establish is that an identity was used from an unfamiliar place to reach specific systems in a specific order. We keep the questions of who was at the other end and whether the employee knowingly participated clearly separate in writing.
How an Identity Assessment Runs from Scoping to Debrief
A proactive assessment for a bank, fund or fintech begins with a written scope and rules of engagement signed by the CISO and, where the results may be shared with regulators or counsel, by the general counsel so the work runs under the direction of counsel. Scoping names the roles to be tested, the systems that are in bounds, the hours of operation and the stop conditions, because a social engineering call that reaches the wrong employee or a lateral movement test that touches a production ledger creates problems the exercise was meant to prevent. Our penetration testing practice and vulnerability assessments are scoped this way whether the engagement is a first look or an annual retest.
Execution then runs in phases that mirror a real intrusion. Reconnaissance from public sources establishes which employees are findable and what the attacker would learn about approval chains. Social engineering tests the human controls at the helpdesk and the wire desk against the written procedure. An assumed breach phase starts from a standard associate workstation and measures how far a single compromised identity can travel toward Active Directory, administrative groups, the SWIFT or wire approval environment and customer data stores. Each phase ends before the next begins so the institution can stop the exercise if the first finding is serious enough to act on immediately, and every action is logged on our side with timestamps so the security team can match our activity against its own alerts and see which ones never fired.
The debrief is where the assessment earns its cost. Findings are presented to the security team first so they can validate them, then to leadership and audit with the business consequence of each path stated plainly, for example which identity could have approved a payment without a second person. Our financial services page describes the regulatory frameworks the written report maps to, and a retest after remediation closes the loop with evidence that the path no longer exists. That retest is what an examiner from a regulator asks for first, so we schedule it in the original proposal rather than leaving it as an afterthought.
Where Financial Institutions Lose the Most Ground
The most expensive mistake we see after a suspected identity compromise is a password reset that leaves the stolen token valid. Changing the password does not revoke refresh tokens unless sessions are explicitly revoked, so the attacker keeps working while the institution believes the problem is solved. Close behind is the helpdesk reset performed on a phone call, which hands the attacker a fresh authenticator enrollment and a clean audit trail that looks like the employee's own request. Reimaging the workstation before anyone collects memory or event logs destroys the record of how the token was taken. Each of these is understandable under pressure, and each removes something the examiner needed.
Preventing them costs less than any assessment. Session revocation belongs in the written incident procedure alongside the password reset. Authenticator changes for anyone with payment or administrative authority should require a callback to a known number and a second approver. Workstations suspected of compromise should be isolated from the network and left powered on until a collection is complete. Sign in and audit logs should flow to storage the institution controls, because short retention in the identity platform works in the attacker's favor. Our guide to common digital evidence mistakes covers the general case, and the identity specific version is short enough to fit on one page of the runbook.
A quieter loss comes from vendor and contractor identities that sit outside the institution's own joiner and leaver process. A payment processor's support account, a core banking vendor's maintenance login or a consultant's guest account often retains access months after the engagement ends, with no one inside the bank watching its sign ins. Our assessments list those identities alongside the employees' and test them the same way, because an attacker who finds a forgotten vendor account faces none of the monitoring applied to staff. The cyber due diligence practice applies the same review to an acquisition target's identity estate before it is joined to yours, when the cost of closing a forgotten account is still trivial.
Turning Findings into a Record Regulators and Boards Can Use
Every engagement ends in a written report, and the form depends on the audience. For an assessment, the report pairs each finding with the evidence that establishes it, the path an attacker would take, the control that failed and the remediation, written so an examiner from a regulator can follow the reasoning without a walkthrough. For a compromise analysis, the report is a timeline of the identity's activity with the supporting log entries attached, which counsel can use to decide on notification obligations and the institution can use to demonstrate that it understood the scope of the event. In both cases the examiner who did the work is the one who signs, and the same person is available to explain it to the audit committee.
Where an intrusion leads to a referral or a civil claim, the record also supports the legal theory. The federal computer fraud statute at 18 U.S.C. 1030 reaches anyone who "intentionally accesses a computer without authorization or exceeds authorized access," and the identity and audit logs are the evidence that access occurred, from where and to what. Counsel decides whether and when law enforcement is contacted. Our examiners have testified in federal and state courts and have served AmLaw 100 firms and Fortune 1000 companies, and the reports are written with that possibility in mind even when the institution expects the matter to stay internal.
Harden Your Financial Institution Against Identity Intrusions
Our financial services page describes the regulatory frameworks this testing maps to. Call Global Digital Forensics at (800) 868-8189 or our New York financial district team at (212) 561-5860 to scope a financial services penetration testing and social engineering assessment. The initial consultation is free.
Reading the Identity Record After a Token Is Stolen
The guide describes how a stolen session token leaves a different trail from a stolen password. This table lists the records an identity examination reads after a token theft at a financial institution, what each shows and the limit it carries, so a CISO and internal audit can see how far the record reaches. Read the limit column, because the record can show an identity was used from an unfamiliar place to reach specific systems, but not who was at the other end. Core banking platforms keep their own clocks, normalized to UTC before a timeline is drawn.
| Record | What it shows | Limit |
|---|---|---|
| Entra sign in log | A token from a new address, device and user agent | Seven or thirty days by license per Microsoft |
| Unified Audit Log | Which mailboxes and files the token touched | 180 days standard per Microsoft |
| Conditional access report | Which policy evaluated the session and why it passed | Policy on the day, not every path |
| OAuth consent grants | Access that survives the token expiring | Persist until revoked |
| Core banking and wire logs | Application activity on the platform | Rarely synchronized to the identity clock |
| Vendor and contractor identities | Standing access outside joiner and leaver process | Often unmonitored after an engagement ends |
| Who was at the keyboard | Not in the record alone | Needs badge, camera or admission to corroborate |
The banking industry case study describes correlating computer artifacts and access records to examine who reached loan and approval systems, the internal privilege boundaries this guide tests.
How to Begin and What Happens on the First Call
Bring an outline of the identity platform and its licensing tier, the roles that can approve or release payments, the helpdesk procedure for authenticator resets, and, for a suspected compromise, the account name, the first sign that something was wrong and what has been changed since. The examiner will ask whether sessions have been revoked, whether logs have been exported, who inside the institution knows, whether counsel is engaged and what the regulators would expect to see. Afterwards you receive a written scope, a timing estimate and a proposal, for either an assessment or an analysis. The initial consultation is free. Call (800) 868-8189 at any hour, or (212) 561-5860 to reach our New York team directly.
Technical References and Further Reading
Related GDF pages for this work: cyber threat assessments and comprehensive penetration testing.
The original article pointed readers to this article published in Information Week’s Dark Reading on Tuesday, June 23rd. Those references are kept for the record.
Authorities cited in this guide: Microsoft Entra data retention for reports and logs. States how long sign in and audit logs are retained by license tier, Microsoft Learn as read in October 2026. Microsoft Purview audit log retention policies. Documents default and extended retention for the unified audit log, Microsoft Learn as read in October 2026. 18 U.S.C. 1030, Fraud and related activity in connection with computers. Federal statute reaching access without authorization or in excess of authorization, Cornell LII text of the United States Code. FTC cybersecurity guidance for small businesses. Plain language reference on reasonable security practice that boards and audit committees can read alongside the report, as published by the FTC.