The Five Controls That Would Have Prevented Every Major Breach in This Series

Action GuidePrevention Framework

June 2026  ·  8 min read

This series has covered more than a dozen of the most significant cybersecurity incidents of the past 18 months. A global retailer. Multiple insurance giants. A real estate firm. A government cybersecurity agency. A global fast food chain. Different industries. Different attackers. Different data. One pattern: the same five controls were missing every single time.

---

Over the course of this series, we've examined breach after breach — analyzing exactly how attackers got in, what they took, how long they went undetected, and what it cost. The incidents span retail, insurance, commercial real estate, government agencies, and fast food. The attackers range from sophisticated groups with documented multi-year track records to small teams who rely entirely on phone calls and social engineering.

The financial impacts range from tens of millions to hundreds of millions of dollars. The reputational damage in some cases exceeded the direct financial cost. And in every single case, the same pattern holds: the breach was preventable. Not with expensive enterprise security tools. Not with a dedicated security operations center. With five controls available to every small business — most of which cost nothing to implement.

83%of all cybercrime losses in 2024 came from social engineering — not malware, not technical exploitsFBI IC3 Annual Report 2024

292 daysaverage time to detect a credential breach — nearly 10 months of free access before anyone noticesIBM Cost of a Data Breach 2025

89%of small businesses have at least one compromised user right now — not historically. Right now.Guardz State of MSP Threat Report 2026

The pattern across every breach in this series is not complexity. It's the gap between what organizations say about security and what they actually have in place. A policy that says "use strong passwords" without a password manager to enforce it. MFA that's available but not enforced. A vendor with access that was never revoked. A help desk that resets passwords for anyone who calls and sounds legitimate. Five gaps. Five controls. One afternoon to close them.

The breach pattern — what every incident had in common

Entry point 1A social engineering call to an IT help desk — someone who sounded legitimate requesting account access, a password reset, or MFA approval

Entry point 2A credential in a breach database — reused across personal and work accounts, tested automatically by credential stuffing tools running 24 hours a day

Entry point 3A vendor or third-party tool with access to internal systems — breached at the vendor level, giving attackers inherited access without touching the target's own network

Entry point 4MFA that could be bypassed — prompt bombing, SIM swapping, session token theft, or real-time phishing relay attacks

Entry point 5Default credentials or unaudited access — a test account never changed, an admin login nobody checked, an OAuth connection granted years ago and forgotten

The common threadNone of these required sophisticated technical capability. Every one was preventable with policy, configuration, and monitoring that cost nothing or close to it.

The five controls — and what each one closes

1

Help desk verification protocol

Policy · Free

The single most impactful control in this series — because it addresses the entry point used in more documented breaches than any other. Every major incident that began with a phone call could have been stopped by one rule: no password resets, no account access changes, and no MFA modifications based solely on a phone call, regardless of how legitimate the caller sounds.

The protocol has three components. First: all IT support requests must be submitted via a ticketing system before any action is taken. Second: if a caller claims to be an employee or vendor, hang up and call back on a known internal number. Third: any request involving admin-level access or MFA changes requires in-person confirmation or a verified video call.

The breaches this closesA major global retailer had attackers inside for 70 days after initial access via a service desk call. A large real estate firm lost half a million CRM records after a vendor support call. A major insurer had tens of millions of records exfiltrated via social engineering against an IT support function. All stopped at step one with a verification policy.

Implement todayWrite a one-page policy: no phone-based access changes without a ticket and callback verification. Send it to your IT provider and your team. Takes one afternoon. Costs nothing.

2

Phishing-resistant MFA with number matching

Configuration · Free

Standard push notification MFA is vulnerable to three documented attack techniques: prompt bombing (flooding approvals until one is clicked), SIM swapping (hijacking a phone number to intercept SMS codes), and real-time phishing relay (capturing and forwarding MFA codes faster than they expire). All three appeared in breaches documented in this series.

Number matching closes prompt bombing immediately — it requires the employee to type a code shown on the login screen into their authenticator app, making automated approval impossible. Phishing-resistant MFA (hardware security keys or passkeys) closes all three by requiring physical possession of a device during authentication.

The breaches this closesEvery breach involving MFA bypass in this series — prompt bombing in coordinated insurance attacks, SIM swapping, session token theft documented in the 89% report — would have required significantly more sophisticated capability with number matching in place, and been impossible with hardware keys.

Implement todayEnable number matching in Microsoft Authenticator: Entra ID admin center → Authentication methods → Microsoft Authenticator → Configure → enable number matching. In Google Workspace: Admin Console → Security → 2-Step Verification. Both are configuration changes — no cost, no new software.

3

Credential monitoring — continuous, not periodic

Monitoring · Starts Free

The 292-day average detection time for credential breaches exists because most organizations check whether their credentials have been compromised periodically — or never. Credential stuffing attacks are automated and continuous. The gap between when a credential is stolen and when it's used against a business system is often hours. Checking once a quarter means the attack succeeds 87 times before you notice.

Continuous credential monitoring watches your domain against breach databases in real time — flagging when a new employee email appears in a breach dump, triggering an immediate password change before attackers test the credential against your systems. The Guardz data shows 31% of SMB users have a compromised credential in any given month. Without monitoring, you have no way to know which 31%.

The breaches this closesA government cybersecurity agency whose credentials sat in a public repository for six months — detected by external monitoring, not internal systems. More than 2,500 credentials harvested from fake World Cup sites already on the dark web. The 89% of businesses with at least one compromised user who have no monitoring to tell them which one.

Start todayGo to haveibeenpwned.com → Domain Search → enter your company domain. For continuous monitoring, Veriti Spottr watches your domain automatically — surfacing new credential exposures before they're tested against your systems.

4

Vendor and access hygiene audit

Policy · Free

The 2026 Verizon DBIR documented that third-party breaches now account for 48% of all incidents — up 60% in one year. Nearly half of all breaches no longer happen through a direct attack on the victim's own systems. They happen through a vendor, contractor, or SaaS platform with granted access whose security is outside the victim's control.

Access hygiene has three components: knowing which vendors have access to your systems, ensuring each has only the minimum access required for their function, and removing access when it's no longer needed. The last one is where most businesses fail — a contractor whose account is still active two years after they left, a vendor with access to your full customer database when they only need to send emails.

The breaches this closesAn insurer whose 1.4 million customer records were accessed through a third-party CRM the attacker never directly targeted. A government agency whose contractor created a public repository with admin credentials. A real estate firm whose CRM data was exfiltrated through a vendor's compromised support team. All third-party access failures.

Implement this weekList every third-party tool with access to your systems. Confirm minimum necessary access for each. Remove or restrict anything broader. Audit OAuth connections: Google Workspace Admin → Security → API Controls · Microsoft 365 Admin → Azure AD → Enterprise Applications. Remove anything unused.

5

External attack surface visibility

Monitoring · Starts Free

The most dangerous security gap isn't the one you know about — it's the one you don't. The open port you never knew was exposed. The DMARC record set to monitor instead of enforce. The admin panel visible from the public internet. The credential in a breach database you never checked. Attackers scan your external attack surface continuously. Most small businesses never look at what's visible from the outside.

External attack surface visibility means knowing what an attacker's automated scanner sees when it hits your domain — before the attacker does. Continuous external monitoring surfaces new exposures as they appear rather than waiting for the annual check that most businesses never get around to.

The breaches this closesThe 43-day average patching window the DBIR documented — attackers exploit known CVEs in hours, but organizations take 43 days to patch. A government agency whose credentials were publicly visible for six months — external monitoring caught what internal monitoring missed. Every breach in this series had external signals that preceded the attack by weeks or months.

Start todayThree manual checks: DMARC at mxtoolbox.com/dmarc, open ports and exposed services at shodan.io, credentials at haveibeenpwned.com Domain Search. These take 15 minutes and surface the most common external exposures. Veriti Spottr automates all three continuously.

A note on cost: none of the five controls above requires purchasing new software. Help desk verification is a policy. Number matching is a configuration change. Credential monitoring starts free. Vendor hygiene is an audit. External visibility starts with three free web tools. The total cost of the controls that would have prevented every major breach in this series is approximately zero dollars and one afternoon.

The implementation checklist

The five controls work as a system. An attacker who can't get through the help desk will try credential stuffing. An attacker who can't use a stolen credential will try session token theft. An attacker who can't get through your front door will try your vendor's. All five matter — not just the most obvious one.

Your five-control implementation checklist

Help desk verification policy written and sent to IT provider and teamNo phone-based access changes without ticket + callback. One page. One afternoon.

Number matching enabled in Microsoft Authenticator or Google WorkspaceEntra ID admin center → Authentication methods → Microsoft Authenticator → Configure

HIBP domain search run and any exposed credentials rotatedhaveibeenpwned.com → Domain Search → your company domain → change any exposed passwords

Vendor access audit completed — unused OAuth connections removedGoogle Workspace Admin → Security → API Controls · M365 Admin → Azure AD → Enterprise Applications

External attack surface checked — DMARC, open ports, public credentialsmxtoolbox.com/dmarc · shodan.io (your domain) · haveibeenpwned.com domain search

The Veriti Spottr CyberScore measures all five controls — the Security Posture survey covers your help desk protocols, MFA configuration, and vendor access practices; the Exposure component monitors your external attack surface and credential exposure continuously; the Business Profile captures your industry risk context. A business that has implemented all five controls will score materially higher — and will be in the minority of businesses that attackers move past because the automated scanner found nothing to work with.

The honest conclusion

Every breach covered in this series generated headlines, investigations, class action lawsuits, regulatory filings, and crisis communications. Every one cost the affected organization more to respond to than the five controls would have cost to implement. And in every case, the root cause was not a sophisticated attack that couldn't be stopped — it was a fundamental gap that had been there, unaddressed, long before the attacker arrived.

The five controls in this post are not a comprehensive security program. They're the minimum — the baseline that stops the attacks actually happening at scale right now. They're the reason some organizations targeted in documented campaigns didn't become breach victims. Those businesses didn't get lucky. They had something in place that made the attacker move on.

One afternoon. Five controls. That's the gap between being in the 89% and not being in the 89%.

📚 Credential Security Series — Read the full series

Part 1 → Your Password Policy Isn't Protecting You. Your Employees' Habits Are. Part 2 → Your Credentials Are Already For Sale. Here's How to Find Out in 60 Seconds. Part 3 → You Turned MFA On. Attackers Already Have Three Ways Around It. Part 4 → What Attackers Do With Your Data in the First 60 Minutes Part 5 → The 30-Minute Security Audit Every SMB Owner Should Do This Week Part 6 → The First 24 Hours After You Discover a Breach

See how your business scores on all five controls. Veriti Spottr's beta is free.

Get your CyberScore →

VS

Veriti Spottr Team AI-powered cyber risk clarity for SMBs  ·  veritispottr.com