Independent operational audit: 11 reference cases
Assess whether TenguProtect can scope, deliver, measure and report each scenario as a client service. Published playbooks and installed tools are supporting evidence; they do not establish operational readiness.
| ID | Reference case / playbook | Business question | Incident evidence |
|---|---|---|---|
| SC01 | French refrigeration attacks · 2026 | Could someone change our refrigeration controls, and would we detect and contain it before stock is lost? | CERT-FR · official alert, updated 13 October 2026 · Le Monde · reported impact, 13 October 2026 |
| SC02 | Caesars · 2023 | Can an impostor turn contact with our staff or support provider into access to customer records? | Caesars · SEC disclosure |
| SC03 | Ubiquiti · 2015 | Would our payment process stop a convincing but unverified supplier or executive instruction? | Ubiquiti · March 2022 financial filing, describing the 2015 fraud |
| SC04 | TalkTalk · 2015 | Could a forgotten page, unsafe query or broken role check expose another customer’s information? | ICO · TalkTalk investigation |
| SC05 | Capital One · 2019 | Could an exposed application, leaked build secret or excessive cloud role reach data it should not? | US Department of Justice · Capital One case |
| SC06 | TJX · FTC action 2008 | Can a guest, nearby device or misleading WiFi login cross into business access or capture sensitive interaction? | FTC · TJX settlement announcement |
| SC07 | Jaguar Land Rover · 2025 | Which digital dependency could halt our operation, and can we contain an incident and restore essential work? | JLR · manufacturing restart statement, 7 October 2025 |
| SC08 | Synnovis / NHS · 2024 | Can we maintain critical work when a trusted supplier’s systems or data exchange become unavailable? | NHS England · dated clinical-impact report |
| SC09 | BLASTPASS · 2023 | Are sensitive mobile users adequately protected, and could we preserve and assess evidence if compromise were suspected? | Citizen Lab · original BLASTPASS investigation |
| SC10 | EchoLeak · research demonstration | Can untrusted content make our assistant expose another customer’s data or request an unauthorised tool action? | EchoLeak · published research paper |
| SC11 | Heathrow USB loss · 2017 | Could someone obtain sensitive information or access through a lost device, visitor process or unattended workspace? | ICO announcement republished by WiredGov, 8 October 2018 |
Evidence to request for every case
- Scope and approvals: named systems, people and exclusions; LOW/MED/HIGH ceiling; allowed methods/channels; current time window; deny and revocation handling.
- Delivery readiness: responsible operator or agent, validated tool versions, usable guides, exact reviewed resources and hashes, functioning dependencies and credentials. Verify the workflow, not merely installation.
- Connected workflow: trace the scenario, target, policy revision and step through the selected tools/teams into evidence and the report. Identify manual handoffs and what happens on failure.
- Measured outcome: inspect each of the three scenario steps for expected/observed results, evidence, denominator or qualitative rubric, limitations and honest NOT ASSESSED/BLOCKED states. A log saying “completed” is insufficient.
- Business report: explain what was demonstrated, what remains unknown, and recommendations to reduce likelihood and impact. Defer implementation allocation, schedules and costs to Part 2.
Return format
For each case report READY, PARTLY READY, NOT READY or NOT VERIFIED, with dated evidence, the delivery route, missing prerequisites and the exact work/evidence needed to close each gap. Distinguish operator-assisted delivery from autonomous agent delivery. Do not combine documentation completeness, task completion and security effectiveness into one percentage.
Download the blank 11-case audit worksheet · Machine-readable playbooks and step mappings · Known connections and remaining gaps · Approval model and synthetic checks
Interpret incident facts carefully
EchoLeak is a research demonstration, not a confirmed customer breach. Heathrow is an accidental device-loss case, not evidence of a building intrusion. Proposed client attack routes and selected tools are hypotheses for assessment, not claims about exactly how every historical incident occurred. Each playbook states its evidence limits.
The starting worksheet is deliberately NOT VERIFIED. This publication has not assessed any client or certified TenguProtect as ready to deliver all 11 services.