New starter.
Fake colleague.
Real attack.
Inside a real attack on Barrier, from digital forensics to AI-powered defence.
An attacker targeted a new starter at Barrier, impersonating another employee and attempting to persuade them to follow a malicious link.
The attempt was recognised and reported to our Security Operations Centre before the attacker gained access. But our investigation did not stop there.
Through digital forensic analysis, we identified the tooling and methodology behind the attack. Then we used AI powered personalised microlearning content from Keepnet Labs to ensure our staff are ready to defend against future attacks.
A genuine attack targeting a new starter at Barrier Networks.
See what our completed investigation uncovered about the attacker.
Watch the intended malware sequence run safely inside an isolated environment.
See how Keepnet Agentic AI helps us prepare people for attacks like these.
Your new starter is learning how you work. An attacker is ready to exploit that.
New employees are still getting to know their colleagues, internal policies and everyday processes. A request that an experienced employee would question may seem entirely plausible to someone who has just joined.
When that request appears to come from a senior colleague, the pressure to respond can be considerable. People want to be helpful, make a good impression and avoid challenging someone in authority.
Attackers exploit that combination of uncertainty, trust and obligation.
Uncertainty creates opportunity
A new starter does not yet know what is normal. They may not recognise an unusual process, communication style or request because they have no established baseline against which to compare it.
Authority creates pressure
When a request appears to come from a senior colleague, people naturally feel pressure to respond quickly, avoid causing friction and make a positive first impression.
Helpful behaviour can be weaponised
New employees want to demonstrate that they are responsive and capable. Attackers can exploit that instinct by creating apparently routine requests that demand immediate action.
Security has to start on day one
Employees need to know from the beginning that they can question unusual requests, verify who is asking and report anything suspicious without worrying that they are inconveniencing someone.
We investigated the attack. Now we're opening the case.
Join Ian McGowan, Founder and Managing Director of Barrier Networks, for a first-hand account of the incident.
Explore the forensic evidence, watch the malware run in a controlled sandbox, and see how we use Keepnet's Agentic AI capabilities to help prepare our people for attacks like these.
Register for the live webinar →Hear the real incident story
See how an attacker impersonated a Barrier employee and attempted to turn a new starter into a route into the organisation.
Examine the forensic evidence
Go beyond the message itself and explore the tooling, methodology and tactics revealed by our investigation.
Watch the intended attack unfold
See the malicious sequence safely demonstrated inside a controlled sandbox and understand what the attacker wanted to happen next.
See how we prepare our people
Explore how Barrier combines day-one awareness with Keepnet's Agentic AI capabilities to make training more relevant and responsive.
See the attack. Understand it. Prepare for it.
This is not a theoretical threat briefing. The session connects a real social-engineering attempt with the technical investigation and the human-risk controls we use in response.
How the attacker approached the new starter
Understand how impersonation, apparent authority, unfamiliar processes and pressure to act combine to make a malicious request appear legitimate.
From suspicious message to forensic evidence
Follow Barrier's investigation beyond the report and examine the technical artefacts that revealed the attacker's tooling, methodology and intended sequence.
Turn what we learned into better preparation
See how personalised learning, realistic phishing scenarios and employee behaviour analysis can reinforce the skills people need when a convincing request arrives.
One real incident. Five layers of the story.
Ian will present throughout, combining a real-world incident response walkthrough, findings from our completed forensic investigation, a malware sandbox demonstration and a demonstration of Keepnet's Agentic AI capabilities.
Why attackers target new starters
Explore how employee impersonation, apparent authority and pressure to act can make these attacks convincing. Understand why unfamiliar policies and processes create opportunities for attackers.
The attack on Barrier
Walk through an attempt to turn a new starter into a route into our organisation and hear how it was recognised and reported before access was gained.
What our digital forensics uncovered
Examine the attacker's tooling, methodology and tactics, techniques and procedures revealed during our completed investigation.
Beyond the malicious link
See what the attacker wanted to happen next. In a controlled sandbox, Ian will demonstrate the attack sequence and malware behaviour.
Preparing people with Keepnet Agentic AI
See personalised microlearning, AI-generated phishing scenarios and employee behaviour analysis in action.
See what the attacker wanted to happen next.
Ian will demonstrate the attack sequence and malware behaviour inside a controlled and isolated environment, showing what happens when the malicious link is followed and the attack progresses.
This is a demonstration of the attacker's intended sequence, not a compromise that took place at Barrier.
Don't wait for the first suspicious request. Prepare people before it arrives.
At Barrier, new starters are made aware from day one that someone may impersonate a colleague and ask them to do something unsafe.
They know these approaches should be reported immediately to our Security Operations Centre.
The objective is not simply to tell people to “be careful”. It is to help them recognise the situation, understand that they can question a request and know how to get support.
Understand the situations and social-engineering techniques an attacker may use.
Give employees confidence to challenge unusual requests, even when they appear to come from authority.
Encourage people to confirm identities and processes before following links or completing sensitive actions.
Make escalation to the Security Operations Centre immediate, familiar and expected.
Make human-risk training more relevant to the risk.
Keepnet is part of how we put our day-one approach into practice.
During the webinar, Ian will show how Keepnet's Agentic AI capabilities connect training with the behaviours and risks that matter.
Personalised microlearning
Short, focused learning tailored to employees' roles, observed behaviour and training needs.
Help people understand the situations they may encounter, rather than relying on the same generic content for everyone.
AI-generated phishing scenarios
Create relevant simulations that prepare employees for realistic social-engineering attempts.
See how AI-generated scenarios can support training around the impersonation and pressure tactics explored during the session.
Employee behaviour analysis
Use training results, simulation outcomes and reporting behaviour to identify where employees need additional support.
Turn those insights into more targeted learning and reinforcement.
Keepnet's approach goes beyond generating content. Its Agentic AI brings content creation, behavioural analysis and adaptive learning together, helping security teams make their awareness programmes more responsive and efficient.
Ian McGowan
Founder and Managing Director, Barrier Networks
Ian has more than 25 years' experience in cybersecurity. His career includes service as a cyber officer in the military and helping organisations defend against some of the most advanced nation-state actors.
He will bring that operational experience to a practical discussion of the attack on Barrier, the forensic investigation that followed and the measures that help employees recognise and report these threats.
For the teams responsible before, during and after an attack.
This session is designed primarily for CISOs, IT leaders and security teams, including those working in security operations, incident response, digital forensics and security awareness.
It is also relevant to HR and people teams responsible for onboarding, particularly those working with security colleagues to ensure new employees understand how to verify requests and report suspicious activity.
See the attack.
Understand the methods.
Strengthen your response.
Join us for a closer look at how attackers target new starters, what our forensic investigation revealed, and how day-one preparation and Agentic AI-supported training help us defend against these approaches.
USE THE FORM BELOW TO REGISTER
The malware demonstration shown during this webinar recreates the attacker's intended sequence in a controlled, isolated environment. It is not a compromise that took place at Barrier Networks.