This is a sample
Kestrel Defense Components, LLC is a fictitious company. Every name, number, hostname, and finding on this page is invented
to show what a Castile Security CMMC Level 2 readiness engagement actually produces. No real client data appears here.
A live engagement dashboard looks and works exactly like this one, populated with your environment instead.
📋 What We Have Found So Far: Plain English
The Short Version
Week 2 · Discover Phase
📂 Your Data
Our scanner found 2,184 files on company computers that match the patterns of federally regulated defense and export data. We are now mapping what protections are in place for those files.
📧 Your Email
In the first week, 14 real phishing emails aimed at your staff were caught by our monitoring tool. It is watching right now, not blocking. That is by design, so we see your actual threat level without changing anything.
👥 Your People
About 1 in 4 employees clicked a test phishing link, and one entered a real password. That tells us where awareness training will have the most impact.
🚪 Health Overview: What We Are Watching
Needs Attention
Federal Defense Data on Company Computers
Files matching federal defense and export rules were found on 31 workstations. We are assessing what protections exist for them.
CEO Account: Highest Exposure
Dana Whitfield's credentials appear in 21 separate breach databases, the highest count in the company, and she was targeted by a real phishing email this week.
Employee Entered Password in Phishing Test
One employee entered their real Microsoft password during our QR-code phishing test. About 27% of staff clicked it. Security awareness training is a priority fix.
Email Threats Reaching Inboxes
9 of 14 phishing emails caught in the first week would land in employee inboxes without additional protection in place.
On Our Radar
Second Login Step Not Enabled for All
5 employees are missing multi-factor authentication, the extra step that makes a stolen password much less useful to an attacker.
Drawings Stored Outside the Approved Boundary
Engineering drawings were found in a personal cloud folder on two workstations, outside the systems the company manages.
Cloud Boundary Not Yet Decided
The company is weighing a move to Microsoft GCC. That decision should follow the CUI determination, not precede it.
Working Well
Email Authentication Is Configured
SPF, DKIM and DMARC are configured to help receiving systems reject unauthorized use of your domain. Lookalike domains and other impersonation attempts remain possible.
No Clicks on Real Malicious Links
Our monitor recorded no employee clicks on the genuine malicious links that arrived by email during the first week.
Scheduled Backups Are Completing
Server backup jobs completed every night this period. Restore testing is still pending; successful jobs alone do not prove recovery.
📊 Castile Security Cyber Score: Where Kestrel Defense Components Stands
Castile Security Cyber Score: Day 1 vs. Today, with Industry Benchmarks
58
Day 1 start
49 ↓
Today
75
Industry avg
80
Insurance
What does this mean?
Our cyber score measures how well your Microsoft 365 environment is protected based on issues found during the assessment.
It dropped from 58 to 49 in the first week, not because anything got worse, but because the tools surfaced exposure that
was not visible before. That is the assessment doing its job. Most companies in this industry score around 75, and cyber
insurers typically want to see 80 or above. Getting there is what the roadmap addresses.
🔍 Three Things We Are Watching Closely
Priority Item 1
Federal Defense Data Found on Company Computers
Our scanner identified 2,184 files matching the patterns of
International Traffic in Arms Regulations: federal rules that restrict who may access U.S. defense technical data. Violations can carry serious fines or loss of government contracts.,
Export Administration Regulations: federal rules governing commercial items with military applications. Requires strict access controls and record keeping., and
Cybersecurity Maturity Model Certification: a Department of Defense program requiring defense contractors to meet specific cybersecurity standards.-regulated
data across 31 workstations. We are now building a picture of what controls exist for those files.
Controls assessment in progress
Priority Item 2
CEO Account Is the Highest-Risk Credential
Dana Whitfield's email address has appeared in 21 separate breach databases, the highest count in the company. A breach
database is a criminal list of stolen passwords for sale online. This week, a real attacker also sent her a convincing
fake invoice notice. Past exposure plus active targeting puts this account at the top of our watch list.
Flagged for priority review
Priority Item 3
Email Threats Are Detected But Not Stopped Yet
Our email monitor saw 14 real phishing attempts in the first week. It is set to watch only, not block, so we get an
honest picture of what your team actually faces. 9 of those 14 would have landed in inboxes without the extra email
protection layer your current Microsoft plan does not include. This is fixable with a license upgrade.
Monitoring · Not blocking
1
Discover Active
Days 1 to 15
›
2
Diagnose
Analysis: Day 15
›
3
Deliver
Readout: Week 4
Day 9 of 15
Discover phase
📊 Key Numbers
Sensitive Files Found
2,184
Across 31 computers · 74 GB scanned
Estimated Data Risk
$426K
Based on file type and federal exposure rules
Leaked Passwords Online
118
Found across 74 employee accounts
Real Phishing Emails (1 wk)
14
Caught by our email monitor
📂 Data Risk: Regulated File Discovery
What this section means
Federal law, specifically
International Traffic in Arms Regulations: federal rules restricting access to U.S. defense-related technical data. and
Export Administration Regulations: federal rules governing commercial items with military applications.,
requires defense-related data to be stored, shared, and accessed with specific safeguards. Our scanner found files matching
those categories across company computers. What controls are currently in place is part of the gap analysis still underway.
Regulated Data on Endpoints
CMMC Scope Under Review
The scan covered all 31 workstations and found 2,184 files matching federal export and defense data categories.
These matches are leads for manual review, not proof of CUI status or a contract requirement. We are evaluating whether
The middle of three CMMC levels, focused on protecting Controlled Unclassified Information (CUI). The required level and assessment type depend on the applicable solicitation or contract.
requirements apply by reviewing the contract, confirming the data types, and mapping the systems that process, store or transmit them.
ITAR: Defense Export Data612 files · $286,000 risk
Files referencing items under federal arms export rules (22 CFR Part 120)
EAR: Commercial Export Data704 files · $121,400 risk
Files referencing items on the Commerce Control List
CMMC: Controlled Unclassified Info388 files · $18,600 risk
Controlled Unclassified Information: government data that is sensitive but not classified. Contractors handling CUI must meet CMMC Level 2 standards.
categories specified by the Department of Defense
Distribution Statement Documents480 files
Documents bearing official distribution restriction markings (Dist. A / B / D / E)
✓ No sensitive data was observed leaving the network. No USB or email export of flagged files was detected during the scan period.
Highest-Risk Computers
Priority for Gap Review
These three computers hold the largest concentration of regulated files. They are the starting point for our controls review.
| Computer | Sensitive Files | Est. Risk Value |
|---|---|---|
| ENG-WS-04 | 842 files | $164,200 |
| SHOP-FLOOR-02 | 571 files | $118,900 |
| QA-DESK-01 | 298 files | $71,300 |
| All other computers | 473 files | $71,600 |
Three computers hold 78% of the total regulated data. Our controls assessment focuses here first.
📋 Note on Risk Dollar Figures
These are estimates generated by the data discovery scanner based on file type and regulatory category. They are indicators of risk scale, not legal determinations. Final findings include context from the controls review.
📧 Email Security: Monitor-Only, First Week
What this section means
Every email coming into the company is examined by our monitoring tool. Right now it is watching, not blocking, so we get an
honest picture of what actually reaches your people without disrupting the business. Think of it as a security camera before
we decide where to put the locks.
Emails Inspected
3,140
All inbound email · first week
Phishing Caught
14
9 would have reached inboxes without protection
Spam Caught
96
Plus 712 low-value marketing emails
Most Targeted Employees
Monitor-OnlyWhy monitor-only? We deliberately do not block email during discovery. This gives us your real threat exposure, what attackers are actually sending, without altering your operations. Blocking is addressed in the remediation plan.
| Employee | Phishing | Spam | Graymail |
|---|---|---|---|
| Dana Whitfield (CEO) | 3 | 28 | 164 |
| Marcus Reyes (Controller) | 3 | 14 | 71 |
| Priya Anand (Engineering) | 2 | 9 | 58 |
| Tom Beckett (Operations) | 2 | 11 | 47 |
| Alicia Moore (Quality) | 2 | 6 | 0 |
| Ray Solano (Purchasing) | 1 | 17 | 39 |
| Jen Kowalski (HR) | 1 | 11 | 0 |
Total graymail this week: 712 emails, an estimated 2.8 hours of employee time lost to low-value inbox clutter.
Real Attacks Caught This Week
Active TargetingFake Invoice Notice from a Known Supplier
Goal: Steal login credentials by impersonating a trusted vendor
Fake Wire Transfer Request
Goal: Financial fraud, impersonating an executive
Fake "Updated Drawing Package" Attachment
Goal: Social engineering aimed at engineering data
Fake Shipping Notification
Goal: Suspicious link from a newly registered domain
Also noted: Employees are using personal cloud storage on company computers. Files placed there sit outside the company's managed systems, which means they are outside your control. This is called Shadow IT refers to apps and tools employees use on their own, without IT approval. These create blind spots: the company cannot see or protect data that ends up in those apps..
🎣 Phishing Simulation: Campaign 1 of 4
What this section means
We sent a test email to all employees that looked like a real attack: a fake Microsoft QR-code sign-in request. No real harm
was done. This tells us how likely your team is to accidentally let an attacker in. Three more test campaigns follow.
QR-Code Office 365 Test: Results So Far
Campaign 1 of 448
Test Emails Sent
13
Employees Clicked
1
Password Entered
Click Rate (Week 1)27%
Typical range for QR phishing simulations: 15 to 25%
Notable: One employee entered their real Microsoft password. That is the single most serious result in this
campaign. In a real attack, that account is now the attacker's account. Credentials were not captured or stored by the
simulation, and the password was reset immediately.
Employees Who Clicked: Campaign 1
Training Priority List🌑 Password Leak Exposure: Dark Web Scan
What this section means
The A hidden part of the internet not reachable through regular browsers. Criminal groups use it to buy and sell stolen data, including usernames and passwords from company breaches.
is where stolen passwords are bought and sold. We checked every company email address against publicly known breach databases.
A match means that person's password from some past breach may be available to attackers.
Leaked Credential Summary
Password Reset Recommended118
Total Breach Events Found
74
Employee Accounts Affected
When an attacker has a list of stolen passwords, they try each one against corporate login pages, a method called
An attack where criminals take usernames and passwords stolen from one breach and automatically try them on other sites and apps, betting that people reuse passwords..
The risk is highest when employees use the same password for work and personal accounts.
Recommended steps:
- Force a password reset for all 74 affected accounts
- Turn on the second login step (Multi-Factor Authentication: a second step beyond your password, like a code on your phone. Even with your password, an attacker cannot log in without it.) for every user
- Start with executive accounts: highest breach counts, highest risk
Highest-Risk Individuals
Priority Reset TargetsHow many times each person's credentials have appeared in stolen data sets:
Dana Whitfield (CEO)21 breaches
Highest in the company, and actively targeted by real phishing this week
Marcus Reyes (Controller)12 breaches
All other affected accounts85 combined
Dana Whitfield is the only person who is both the top breach target and actively targeted by real attackers this week.
That combination makes this the highest individual-level risk we have found.
✓ Email authentication helps reduce domain spoofing. Your email authentication (SPF, DKIM, DMARC) is correctly set up, which helps receiving systems identify spoofed messages but does not prevent all impersonation.
☁ Microsoft 365 Security: Report Card
What this section means
Microsoft gives every customer a security score from 0 to 100 that rates how well your Microsoft 365 account is configured to
defend against attacks. A higher score means more protections are turned on. The score here is your starting point. Many of the
improvements are configuration changes or license upgrades, not complex technical projects.
Microsoft Secure Score Overview
Room to Improve31%
Your Score
Microsoft rates the account at 22 of 71 recommended security steps completed. A well-configured account
for a federal contractor should score above 70%. The biggest gap is a missing email security upgrade, the same feature
that would have blocked most of this week's phishing attempts.
Security Steps Completed22 / 71
Second Login Step (Multi-Factor Authentication: requires a second form of ID beyond a password, like a phone approval or code.) for All Users6 of 11 regular users
5 regular accounts have no MFA; each is a potential easy entry point
MFA: Admin Accounts7.5 of 10
Nearly complete; at least one admin account still without this protection
Top Gaps to Address
License + Settings| What Is Missing | Fix Type | Score Improvement |
|---|---|---|
| Safe Links & Safe Attachments (blocks malicious links/files) | Upgrade needed | +6.90% |
| Anti-phishing protection (stops impersonation attacks) | Upgrade needed | +13.2% |
| Identity risk detection (flags suspicious logins) | Upgrade needed | +4.80% |
| Data loss prevention policies | Settings change | +2.10% |
| Turn on MFA for all regular users | Settings change | +1.90% |
| Turn on full mailbox audit logging | Settings change | +1.20% |
The phishing emails caught this week are exactly what the missing email security upgrade is designed to stop. Addressing
the license upgrade and the settings changes would push the score above 55% and close the most immediate threats.
🔑 Identity & Access: Who Can Get In
What this section means
Every login is a door. This section counts the doors: how many accounts exist, who holds the keys that open everything (admin access), and whether any doors were left open after someone left the company.
Account Inventory
2 Items to ReviewTotal User Accounts19
Accounts With Admin Rights6 of 19
A well-scoped environment this size usually needs 2 to 3
Shared / Generic Logins Found3
A shared login makes it impossible to know who actually did what
What We Found
Needs a Decision| Finding | Why It Matters |
|---|---|
| 2 accounts still active for staff who left over 90 days ago | Access Risk |
| Warehouse floor shares one login across 4 people | No Accountability |
| No scheduled review of who has admin access | Process Gap |
None of this is unusual for a first assessment. The fix is a one-time cleanup plus a standing quarterly access review, which we help set up.
💻 Endpoint Protection: Every Device That Touches Company Data
What this section means
An unprotected laptop is an open door with your company's name on it. We check every company device for three things: is it protected, is its hard drive encrypted, and is it up to date.
Device Coverage
27 of 31 Fully CoveredEndpoint Protection Installed
Antivirus and monitoring active on company-owned computers.
● 29 of 31 devices
Disk Encryption Enabled
Protects data if a laptop is lost or stolen.
● 22 of 31 devices
Fully Patched Operating System
Devices running current security updates.
● 18 of 31 devices
Personal (BYOD) Devices Used for Work
Phones and home computers reaching company email or files.
● 4 devices identified, unmanaged
Two shop-floor workstations are unpatched and two full versions of Windows behind. They are now the fastest way in, and the first fix on the roadmap.
🛡 Perimeter & Backups: The Edge, and the Safety Net
What this section means
The perimeter is everything visible to the internet, the doors an outside attacker can actually try. Backups are the safety net if all of that fails anyway. We check both, because a strong front door means less if the safety net has a hole in it.
What's Visible From the Outside
2 Findings| Exposed Service | Risk |
|---|---|
| Remote desktop port open to the internet on one server | High |
| Old file transfer service still reachable, unused since 2023 | Medium |
Scan covers the same public footprint an attacker would see first, before ever touching a password.
Backup Verification
UntestedCritical Systems With Backups Configured100%
Backups With a Verified Restore Test0%
Backups exist and run every night. Nobody has confirmed the data actually comes back.
This is the single most common gap we find, and the most dangerous. A backup nobody has restored is a guess, not a plan. The first real restore test is scheduled for week two.
🔧 Tools Running
Assessment Tool Stack
All Tools ActiveData Discovery
Scans all company computers for files that fall under federal defense and export rules. Tells us what regulated data exists and where it lives.
● Active · 31 computers scanned
Posture & Dark Web Monitoring
Monitors the Microsoft 365 environment for security gaps, checks employee accounts against breach databases, and tracks the overall security score.
● Active · Cyber Score 49% ↓ from 58%
Email Security Monitor
Monitors all inbound email for phishing, malware, and spam. Currently watching only, not blocking, to give an honest picture of real threats.
● Monitor-only · Does not block or filter
Phishing Simulation
Sends realistic test phishing emails to all employees. Measures click rates and credential submission to assess awareness. Four campaigns.
● In Progress · Campaign 1 of 4
All tools are temporary and are removed when the assessment closes. No tool is blocking, filtering, or modifying operations during this period.
📁 Evidence Trail: What's Documented So Far
What this section means
CMMC is not just fixing things, it is proving they are fixed. Every control needs an artifact behind it: a policy, a screenshot, a log, a signed acknowledgment. This is our running record of what has been collected and what is still open, organized by control family.
Evidence Collected by Control Family
18 of 42 Items| Control Family | Evidence Item | Status |
|---|---|---|
| Access Control (AC) | Account inventory and access review log | Collected |
| Identification & Authentication (IA) | MFA enforcement configuration export | In Progress |
| Media Protection (MP) | Data sanitization and disposal procedure | Not Started |
| Incident Response (IR) | Incident response plan and contact tree | In Progress |
| System & Communications (SC) | Network diagram and boundary documentation | Collected |
| Awareness & Training (AT) | Signed training completion records | Not Started |
Evidence collection runs alongside the technical work. Nothing here blocks the assessment; it is the paper trail that makes the eventual score defensible.
📦 Deliverables: What You Actually Get
What this section means
Every engagement ends in documents you keep, not just a number. Here is what is included, and where each one stands right now.
Gap Assessment Report
Every control checked against your actual environment, in plain English.
● In progress
System Security Plan (SSP)
The core CMMC document describing how your environment meets each control.
● In Progress
Plan of Action & Milestones (POA&M)
A dated plan for closing every open gap.
● In Progress
Policy Set
Written policies covering access, data handling, incident response, and more.
● Scheduled, Week 3
Executive Readout
A live walkthrough of every finding with your leadership team.
● Scheduled, Day 15
Live Dashboard, Yours to Keep
This view, updated as remediation continues after the assessment closes.
● Included, Ongoing
⚠ Risk Register: What We Are Tracking
Findings Logged to Date
Click any row for detail · Final risk ratings come at the readout
ITAR / EAR regulated data found on company endpoints; controls assessment in progress
Critical
Source: Data Discovery
›
1,316 files matching ITAR and EAR classification patterns were found across company workstations. Federal export
regulations require specific controls for this data, including access restrictions, user authorization records, and
audit logging. Whether those controls are in place is a key question the gap analysis answers. Scanner matches require validation against contract requirements, data ownership and system boundaries before CMMC scope is established.
Files FoundITAR: 612 · EAR: 704
Estimated Risk Value$407,400 combined (ITAR + EAR)
Related CMMC RequirementsAC.L2-3.1.1, MP.L2-3.8.3, SI.L1-3.14.1
Next StepControls assessment; gap analysis at readout
Employee submitted real credentials during phishing simulation
Critical
Source: Phishing Simulation
›
One employee entered their real Microsoft password into a simulated QR-code phishing page. In a genuine attack this
results in immediate account takeover. The password was reset the same day and no credentials were retained by the
simulation platform. CMMC Level 2 requires documented security awareness training.
Click Rate27% (13 of 48 recipients)
Credentials Submitted1
Related CMMC RequirementAT.L2-3.2.1 (Awareness Training)
FixTargeted training + repeat simulation in 30 days
CEO account: 21 credential breaches plus active phishing targeting this week
High
Source: Dark Web + Email Monitor
›
The CEO's email has the highest breach count in the company (21 events) and was the target of a convincing fake invoice
notice this week. She also receives the most spam of any employee. High past exposure plus active current targeting makes
this the highest individual-level risk found so far.
Breach Events Found21 (highest in the company)
Active Phishing AttemptFake invoice notice · Day 3
Recommended StepsForce password reset · verify MFA · executive awareness
PriorityImmediate
Email threat protection is watching but not blocking; 9 of 14 phishing emails would reach inboxes
High
Source: Secure Score + Email Monitor
›
The email security features that block phishing (Safe Links, Safe Attachments, and anti-phishing policies) require a
Microsoft Defender for Office 365 license the company does not currently hold. Without it, Microsoft would deliver 9 of
the 14 phishing emails detected this week directly to employee inboxes.
Phishing Emails at Risk9 of 14 would reach inboxes
Score Impact of Fix+13.2% from anti-phishing config alone
Fix TypeLicense upgrade + policy configuration
Related CMMC RequirementsSI.L1-3.14.2, SC.L2-3.13.13
Second login step (MFA) not enabled for 5 employee accounts
High
Source: Microsoft Secure Score
›
5 of 11 regular user accounts do not have multi-factor authentication enabled. With 118 breach events across employee
accounts, these 5 users are the most vulnerable to account takeover. MFA is a CMMC Level 2 requirement and one of the
highest-return security steps available. It stops most credential-based attacks even when a password has been stolen.
Accounts Without MFA5 of 11 regular users
Related CMMC RequirementIA.L2-3.5.3 (Multi-factor Authentication)
Effort to FixLow: settings change, no license needed
PriorityFix before the readout
Regulated drawings found in personal cloud storage on two workstations
Medium
Source: Data Discovery
›
Engineering drawings matching export-controlled patterns were found in a personal cloud storage folder synced to two
company workstations. Data placed there leaves the company's managed environment. CMMC requires that controlled data be
stored only in authorized systems.
Affected SystemsENG-WS-04, QA-DESK-01
Related CMMC RequirementsSC.L2-3.13.16, CM.L2-3.4.7
FixBlock via access policy + data loss prevention rule
PriorityAddress in the 30-day plan
📅 Timeline & What Has Changed
Assessment Timeline
Day 1
Engagement Signed & Kickoff
Agreement signed · tool deployment plan confirmed
Day 2
Tools Connected
Data discovery, email monitor, posture monitoring, and phishing simulation all active
Day 3
Starting Point Established
Cyber Score: 58 · Dark web scan: 118 breach events found
Day 7
Data Scan Complete
2,184 regulated files found · $426,000 at risk · CMMC scope under review
Days 2 to 15
Phishing Tests Running
4 campaigns · Campaign 1 (QR code) complete · 27% click rate, 1 credential submitted
Day 15
Data Collection Closes
All tool data compiled · gap analysis drafted · estimated CMMC score calculated
Week 4
Executive Readout
60-minute session · Top gaps · 90-day action plan · full deliverable package
Day 1 vs. Today: What Changed
What we knew on Day 1 → What we know today (Day 9)
Day 1: Starting Point
Cyber Score58
Breaches found118
M365 Secure Score31%
Regulated filesUnknown
Email threats seenUnknown
CMMC levelExpected L2
Day 9: Today
Cyber Score49 ↓
Breaches found118
M365 Secure Score31%
Regulated files2,184 found
Email threats seen14 (first week)
CMMC levelL2 under review
Nine days in, the picture is filling in. The cyber score dropped from 58 to 49, not because anything got worse, but
because the tools surfaced exposure that was not visible before. Scores will not change until remediation begins. The
readout is where all of this connects to a clear action plan.
👤 Your Castile Security Team
JV
Jesus Vicente Jr
Founder · Lead Advisor
jesusv@castilesecurity.com · 915-995-2495
SO
Sebastian Ochoa
Lead Cybersecurity Operations Technician
sebastian.ochoa@castilesecurity.com
DF
Dante Flores
Business Development Representative
dante.flores@castilesecurity.com
JK
Dr. Jessica Klein
CMMC Compliance Advisor
jessica.klein@castilesecurity.com
