What Josh demonstrated

Built an end-to-end breach triage and response workflow: identified a phishing entry point, traced the attacker through anomalous logins and kill-chain stages, selected defensible containment actions, and drafted a GDPR Article 33 notification with the required facts. Also connected the method to the real Continental case by arguing for application allow-listing as the highest-leverage control to stop execution and reduce dwell time.

• Leakage-Free Incident Triage
• Log-Based Attack Path Reconstruction
• Kill-Chain Mapping and Containment Sequencing
• Risk-Based Security Communication