Skip to content

Case studies

What actual data access revealed.

These findings came from real production data-access telemetry. The organizations are anonymized, but the activity, timelines, and figures are real.

AMAZON S3FRAUD PREVENTION

15,853

successful deletions

  • 309 TBread across 8 buckets
  • 44 GBprod models read by a dev-named role

An external AWS account had working delete access to production data

15,853 successful deletions and 309 TB read across eight buckets came from an AWS account outside the primary estate. A CI role named for the dev environment was reading 44 GB of production decision models.

Trailox external access: buckets read by identities and clients outside the primary accounts

AMAZON S3SECURITY TOOLING

19,600

denied reads, vendor one

  • 342buckets affected
  • 1,700buckets, vendor two

Security tools were silently missing parts of the data estate

Roughly 19,600 denied reads across 342 buckets for one security vendor, and 5,900 failed calls across 1,700 buckets for another: coverage gaps invisible from either vendor’s own console.

Trailox identities: the identities reading data, each with its allowed and denied requests
Requests per identity: the share that succeeded and the share that was denied
Identity or clientRequests
prod-etl-workerMachine99% ok · 1% denied · 14.2M
UnauthenticatedUnknown78% ok · 22% denied · 0.76M
sso-administratoraccessHuman97% ok · 3% denied · 1.1M
user-reportgeneratorMachine94% ok · 6% denied · 3.4M
legacy-backup-runnerMachine99% ok · 1% denied · 0.21M

AMAZON S3CLIENT INTEGRITY

214

days undetected

  • 1published CVE
  • EOLSDK version in production

An end-of-life SDK with a published CVE remained in production for 214 days

An end-of-life SDK version with a published CVE was reaching sensitive buckets continuously for 214 days.

Trailox client fingerprints: client changes per identity, flagged by type

Client fingerprint changes

2 stack changes
  • prod-etl-workerRisk9.6, high risk
    Stack changeaws-sdk-go/1.51.3 changed to python-requests/2.31.0
  • legacy-backup-runnerRisk7.2, medium risk
    Stack changerclone/v1.64.2 changed to python-requests/2.31.0
  • sso-administratoraccessRisk3.4, low risk
    Runtime changeaws-cli/2.17.4 Darwin changed to aws-cli/2.17.4 Windows

Figures are from production access telemetry. Verticals are stated at a level that does not identify the organization.

Cleared

Not every anomaly is a threat.

Behavioral detection is useful only if it can distinguish meaningful changes from legitimate activity. Trailox provides the evidence needed to investigate both.

  • Delta lakehouse activity

    Confirmed expected catalog-driven access.

  • Terraform activity

    Confirmed expected infrastructure automation.

  • Large delete event

    436,000 object deletions confirmed as legitimate engineering cleanup during the expected operating window.

Want this report
for your own logs?

Free 14-day Data Access Review. Read-only. First findings in 48 hours.

Get a DemoSee what we detect