Professional services · Security
4,000 AI-driven login attempts a week — and none got in
Anonymized · representative engagement
The firm's site was a marketing brochure with a contact form and a client-intake chatbot bolted on. Nobody had looked at the server logs in a year. When we did, the picture was modern: adaptive credential attacks, scrapers pulling every page hourly, and a chatbot that would happily relay whatever a visitor typed into the intake form.
4,120
attack attempts blocked per week
0
open vulnerabilities after hardening
−48%
bot bandwidth (and hosting cost)
3
staff onboarded with tested notifications
The operations log
Day 1
Exposure audit
Autonomous agentLogin endpoint open to unlimited attempts, XML-RPC enabled, user enumeration possible, version disclosed. Intake form fed an AI assistant with no sanitization.
✓ 9 findings, 3 highDay 1
Login and API surface locked down
Timberwright engineerRate limits, lockouts, XML-RPC disabled, enumeration closed. Attack attempts didn't stop — they just stopped mattering.
✓ 4,120/wk blockedDay 2
Prompt-injection path closed
Timberwright engineerIntake submissions sanitized and isolated before anything reaches a model; the assistant can no longer be steered by what a visitor types into a form.
Week 1
AI scrapers throttled
Autonomous agentCrawlers ignoring robots.txt fingerprinted and rate-limited; search engines untouched. Hosting bandwidth fell by nearly half.
✓ −48% bot trafficWeek 2
Partners and staff onboarded
Timberwright engineerThree portal seats, each with sign-in and preview-ready notifications tested end to end. Requests now come from the people who need the changes.
Every night
Security sweep
Autonomous agentExposure probes, dependency updates staged and promoted, backups restore-tested. Findings become fixes; fixes become log entries the partners can read.
Attacks are automated now. Defense has to be too — and it has to be visible, so a business owner can see the 4,000 attempts that didn't work instead of discovering the one that did.