EN

A duck rarely comes alone

We're already in. Good thing it's just a duck.

The duck arrived in the post, you scanned the code, and now you are here. An attacker would already have won at this point. Don't worry, this is not a real attack and nothing has happened to your device. But that is how easy it is.

Book a call See Security Awareness Training

WE HAVE ALREADY LOOKED AROUND

This is what your device just gave away.

We had these details the moment this page opened, without asking a single question. Every website gets them. For an attacker this is step one: they now know which network you come from and which device you use. Next to it is the latest warning from our alert channel that matches it. They cannot tell whether your device is already updated. They can try, though.

What we already know about you
Device, system, browser
…
Network and IP address
…
Latest warning for your system
…
Latest warning for your browser
…

Want to know what else an attacker can find out about your company?

Get in touch

THAT EASY

What just worked.

Bait that arrives by post or is left in the car park is an old trick, and it still works. Instead of a duck it is a USB stick, a promotional gift or a parcel with a QR code.

01

A gift builds trust

Nobody suspects a rubber duck. Attackers count on that: curiosity and politeness move faster than any security policy.

02

A QR code hides where it leads

With a link in an email you can check the address first. With a QR code you only see it once the page is already open. Security people call this quishing.

03

The phone sits outside the firewall

The code is scanned with a phone, often over the mobile network. The filter in the company network never sees it. A real attack page would now have asked for your Microsoft 365 password.

WHEN IT GETS REAL

What an attacker would do next. And where we stop them.

A real attack does not stop after the click. For every step, neonotu has a tool or a team that spots it or prevents it.

  1. veyrisk · Findings
    Critical3
    High9
    Medium8
    Step 01 / 05

    Map the attack surface

    Before the attack, they look for open doors: forgotten subdomains, old login pages, an unpatched VPN gateway. veyrisk finds them first and tells you what to close first.

  2. neonotu · Phishing simulation
    64%reported
    24%ignored
    12%clicked
    Step 02 / 05

    Steal credentials

    A fake login page captures the password. In our Security Awareness Training your team learns to recognise such pages, and quarterly phishing simulations show whether it has stuck.

  3. Valar · Firewall log
    BLOCK 185.220.101.4 → vpn · brute forceALLOW 10.0.4.12 → mail-01 · smtpBLOCK 45.155.205.9 → web-01 · exploit
    Step 03 / 05

    Get into the network

    With the stolen details they try to log in to the VPN or pull in malicious code. Valar blocks this at the edge. IPS, SSL inspection and web filtering are included in every licence.

  4. Strider · Incidents
    Critical SSH login from unknown IP on db-0294% confidence · 14 events
    IsolateLockTicket
    Step 04 / 05

    Spread through the network

    If they do get in, they get noticed. Strider condenses thousands of events into a few incidents, and our SOC in Munich watches around the clock.

  5. Sightadel · Evidence locker
    Phishing-Simulation_Q3.pdfCounts for ISO 27001 A.6.3 and NIS2 Art. 21
    Step 05 / 05

    Respond and document

    In an emergency our incident response team is available around the clock. In Sightadel you record training, tests and measures straight away as evidence for NIS2 and ISO 27001.

EXAMPLES FROM YOUR INDUSTRY

What this can look like for you.

Manufacturing and SMEs

One click in the design office, and production stops the next morning. Valar separates the office and production networks, and Strider flags unusual access before machines stand still.

Valar Strider SOC as a Service

Medical practices and healthcare

Patient data is especially valuable to extortionists. Valar 1 is built for small sites with up to about 25 users, and the short awareness modules fit into a busy practice.

Valar Security Awareness Training

Law and tax firms

Client data, remote access and service providers with broad rights. Our SOC notices when an account is suddenly used differently, and the leak check shows which passwords are already circulating.

SOC as a Service Leak Check Strider

Retail and e-commerce

An attack pays off most when revenue is highest. veyrisk keeps an eye on shop subdomains, certificates and login pages, including the ones forgotten at the last relaunch.

veyrisk SOC as a Service

Public sector and critical infrastructure

NIS2 and critical infrastructure rules require documented security. Valar is engineered in Europe and not subject to the US CLOUD Act, and Sightadel and our NIS2 consulting guide you through the requirements.

Valar Sightadel NIS2 Consulting

THE NEXT DUCK

So your team spots the next duck.

One mandatory session a year changes little. Our Security Awareness Training runs all year: short online modules every month, real phishing simulations every quarter and an on-site workshop twice a year. The evaluation shows where gaps remain. And if you want to know how your organisation reacts to a real duck, we test it with a social engineering assessment.

  • Monthly online modulesShort enough for a working day
  • Quarterly phishing simulationsWith an evaluation of who reports and who clicks
  • Evidence for audits and insurersWhat your team has learned is documented
The rubber duck with its QR code on a desk, next to a phone showing a warning

NO REAL DANGER. THIS TIME.

Let's keep it to the duck.

In a short call we show you where your company is vulnerable and what to tackle first. You can keep the duck.

Book a call

Contact

Reputation takes years. Destruction takes seconds.

Talk to us before somebody else does. The first conversation is free and we reply the same business day.

Send an inquiry Call in an emergency