Domain admin in under three hours, from a parking lot

The question

Leadership wanted to know what a motivated outsider could do in a week with no inside help: get in, establish a foothold, and reach what matters.

How we approached it

Six hours of open surveillance from the next building's lot, badge templates taken from employees' public photos, two pretexted entries, and a small implant behind an empty office desk with three independent callback channels.

What we found

• Six hours of visible surveillance with directional antennas drew no challenge from guards, staff or the neighbouring tenant.
• A failed badge scan at a guarded entrance was waved through on a pretext; a side door was held open for us on a smoke break.
• A service account hash captured in a ten-second Responder run cracked in seconds, giving domain admin under three hours after entry.
• An after-hours walk found more than thirty passwords on sticky notes and unlocked cabinets holding HR records with Social Security numbers.

What it meant

Domain admin was the smaller finding. A week of activity that nobody questioned was the culture finding, and culture findings are what actually move a security program.