A fake onboarding email opened a real security gap, showing how even mature defences fail when assumptions go untested.
A new hire’s first week is meant to be about learning, not defending. For one of the world’s largest B2C retailers, a phishing simulation became the starting point of something much bigger. One overlooked detail put the entire network at risk.
Their defences were mature: a global SOC, internal red teams, and certified processes built around ISO 27001. But maturity doesn’t equal immunity. They wanted to know if their systems could withstand an attack that mirrored the persistence of a real adversary.
This is the story of how a single phishing email exposed the gap between perceived and actual security.
The phishing simulation
Our brief was clear: act as an external APT with no insider knowledge and see how far we could get. No code access, no architecture documentation. No hints. Our approach mirrored how a genuine threat actor would operate, testing not just technology but human response.
A new employee, still in onboarding, received a CovertSwarm phishing email. Believing it was part of an internal workflow, they clicked. In that moment, we captured valid credentials and MFA tokens.
The discovery
The employee realised the mistake quickly and reported it. The organisation responded in line with procedure: accounts locked, credentials reset. But one gap remained. The VPN session opened during the phishing simulation stayed active, giving us a channel straight into the network.
From there, we moved laterally and dug deeper. Inside the company’s Citrix environment, we found an unauthenticated application with a remote code execution flaw, the Citrix vulnerability that gave us our foothold. Within moments, our Command and Control infrastructure was running inside their estate, silent and unseen.
The breach
From a single phishing simulation, we reached critical systems without detection. The client’s defensive tools were in place, but they weren’t tuned to catch this type of intrusion. Our activity went unnoticed.
Well-structured incident response plans can still falter when a live attack behaves differently from the model they were built to counter. The gap wasn’t a process failure. It came from a blind spot that only constant, real-world testing uncovers.
The call to action
This retailer learned that no security strategy is complete without ongoing validation. A single phishing simulation exposed what months of ISO 27001-certified process hadn’t. That VPN session stayed alive long after the incident was declared closed. Every organisation has a version of that gap. If we can find it, a real attacker eventually will.
What’s still open in your network after your last incident was “closed”?
Don’t just close the incident. Close the session too. Contact CovertSwarm and see your security through an adversary’s eyes.