IT advice · audit · incident investigation

Technology advisor for your business.

I advise on IT, cybersecurity, data protection and AI. I carry out independent IT audits and investigate suspicious activity on computers and in Microsoft 365.

Check

Email protection

Can someone send emails in your company’s name?

Only public DNS records are checked: MX, SPF, DKIM and DMARC. The check runs on this website’s server and the domain is not stored.

Incident investigation

What happened to the accounting mailbox?

I build a timeline from the logs and name the data source for every event. Anything that could not be established is marked separately.

  1. Day 1 · 02:13

    Sign-in to the mailbox from an unknown IP address in the Netherlands

    The account had never been accessed from that country before.

    Confirmed

    Entra ID sign-in log · user: accounting@••••••.lt · IP 185.•••.•••.41 · Result: Success

  2. Day 1 · 02:14

    No additional verification was requested

    The sign-in used a previously issued token, so a second factor was not required.

    Confirmed

    Entra ID sign-in log · Authentication requirement: single-factor · Token: previously satisfied

  3. Day 1 · 02:19

    A mailbox rule was created to hide emails containing the word “invoice”

    Such emails were moved automatically to a rarely used folder.

    Confirmed

    Unified Audit Log · Operation: New-InboxRule · MoveToFolder: RSS · SubjectContainsWords: sąskaita

  4. Day 1 · 02:31

    46 emails about invoices were read

    Correspondence with clients about unpaid invoices was reviewed.

    Confirmed

    Unified Audit Log · Operation: MailItemsAccessed · Count: 46

  5. Day 2 · 09:02

    A client received an email with a changed bank account number

    The email was sent from the same mailbox and looked like a normal message.

    Confirmed

    Message Trace · Sender: accounting@••••••.lt · Subject: Re: Invoice No. ••••

  6. Before day 1

    How the sign-in credentials were obtained

    Logs of earlier events were no longer retained, so the source could not be established.

    Not established

    Log retention period: 30 days · No data on earlier sign-ins

What can happen when a mailbox is taken over

  • Clients pay into the fraudsters’ account. The money is often not recovered.
  • The fraudsters see all correspondence and can continue conversations in your name.
  • Emails are sent from the mailbox to other clients and partners.
  • If the mailbox held personal data, you may have to notify the data protection authority within 72 hours.

One of the investigated cases. Company and personal details have been removed.

Advice

How I can help

You can come with a single question or agree on ongoing support. We agree on the scope before starting.

IT management

I review the systems you use, supplier proposals and planned purchases. I help decide what is worth changing, how much to spend and who should be responsible.

  • A list of systems and suppliers with responsible people.
  • Review of purchases and supplier proposals.

Cybersecurity

I review accounts, access rights and security settings. I explain where I see risk, what to fix first and how to prepare for possible incidents.

  • Review of accounts and access rights.
  • A list of settings to fix, ordered by importance.

Independent IT audit

I assess work done by your IT supplier or administrator, the access rights granted and the security settings. I check whether the work matches the agreed scope and state what should be fixed.

  • Review of the work done and selected systems.
  • A written report with findings and recommended fixes.

Scope, price and timing are agreed individually.

Digital incident investigation

I analyse unusual activity on a computer or in Microsoft 365. I collect and preserve the available digital evidence, build a timeline and prepare a report with findings.

  • Analysis of suspicious sign-ins, account activity and file changes.
  • Data sources, timeline and documented findings.

The price is set after reviewing the situation and the available data.

Case study ↑

Data protection (GDPR)

I help you find out what personal data you process, who receives it and what protection it needs under the GDPR. I review processes, supplier roles and staff responsibilities.

  • A list of processed data and its recipients.
  • Review of supplier contracts and data processing terms.

Artificial intelligence

We discuss which tasks AI could help with. I review the chosen tools, the data involved and how staff will check the results.

  • Tasks that suit AI.
  • AI usage rules for staff.

Services online

Services and prices

Small, clearly defined jobs with the price stated up front. Each service lists its scope, timing and result.

Run the check and I will mark the services that suit you. Start the check ↑

01 / SecurityBased on your check

Microsoft 365 security review

A review of accounts, access rights and security settings.

1-3 working days

from €190

02 / SecurityBased on your check

Email domain protection

Setting up SPF, DKIM and DMARC records so that spoofed emails cannot be sent in your name.

1-2 working days

from €120

03 / Artificial intelligenceBased on your check

AI adoption plan

I assess which of your tasks suit AI.

1-5 working days

from €210

04 / AutomationBased on your check

Automating one process

A repetitive task done automatically.

2-5 working days

from €290

05 / AdviceBased on your check

Strategy consultation

Discuss a decision with an independent advisor.

60 min.

€150

Placing an order is not a payment. After you place an order, I first send you a proforma invoice. If you would like to agree on exact terms, price or timing, share more details, or get an offer with an exact price, email me at arthur@consiliumprive.com.

How ordering works

  1. 1You choose the services and submit an order.
  2. 2Within one working day I send you a proforma invoice.
  3. 3Once it is paid, we agree on the information needed and I start work.

No VAT is added: the service provider is not registered for VAT.

Working together

How I work

You work directly with me. My findings are based on verified data, and I explain what that data does and does not show.

  1. 01 /

    We discuss the task

    You tell me what you are facing and what you expect. We agree on the information needed for the work.

  2. 02 /

    We agree on the work

    We agree on scope, price and timing. You know in advance what I will do and what you will receive.

  3. 03 /

    I do the work and explain the results

    I deliver findings or recommendations. We discuss the next steps and who will take care of them.

Contact

Let’s discuss
your question.

Tell me what you want to solve or check. If you ran the check, its results will be added to your message.

arthur@consiliumprive.com

Company details

Company code
Why The Hell Not. MB, 308177183
Registered address
Perkūnkiemio g. 19 LT-12120 Vilnius
Bank
Swedbank
Account
LT96 7300 0102 0684 1031

Consilium Privé services are provided by Why The Hell Not. MB.

Selected services

Cart

Enquiry

How can I help?

I will use your details only to reply to this message. More in the Privacy policy.