When infrastructure evidence becomes a defensible decision.
Customer identities remain redacted. Each story focuses on the operating condition, the Ollandi control applied, and the decision the organization needed to make.
01WEST AFRICAFINANCIAL SERVICES
From fragmented ATM incidents to an estate-level operating picture.
THE CONDITION
Availability, cash, hardware, communications, security, vendor, and service-window data lived across different teams and systems.
OLLANDI’S ROLE
The ATM DIP connected terminal condition to customer consequence and ownership while Ollandi preserved the developing incident chronology.
THE OPERATING OUTCOME
Operations could distinguish local terminal conditions from wider estate patterns and route the next action with the relevant evidence attached.
02AFRICA · CUSTOMER REDACTEDCLOUD INFRASTRUCTURE
A privilege change became a contained identity-and-cloud incident.
THE CONDITION
A valid service identity received elevated access and began low-noise activity through legitimate control-plane interfaces.
OLLANDI’S ROLE
Cloud and Identity evidence formed competing hypotheses. Reversible containment was checked against policy, dependency, confidence, and blast radius.
THE OPERATING OUTCOME
The incident record connected the privilege change, subsequent activity, decision path, containment state, and verification evidence.
One threat sequence across endpoint, identity, network, and runtime.
THE CONDITION
Separate security products observed valid credentials, unusual execution, a rare network destination, and workload behavior without one shared explanation.
OLLANDI’S ROLE
Four DIPs contributed to persistent state, allowing the sequence and likely propagation path to be evaluated as one incident.
THE OPERATING OUTCOME
Responders received a common threat picture, the smallest proposed containment scope, and one evidence bundle for review.
EVALUATE YOUR OWN INCIDENT
Bring a live condition or a historical case. We will map the DIPs, evidence, authority, and verification path.
