Sophie Bovy
Cloud Investigations: The Missing Link in Incident Response
Business Email Compromise (BEC) attacks continue to escalate, with reported losses reaching $2.9 billion in 2023 alone, according to the FBI Internet Crime Report. When an incident happens, incident responders are under immediate pressure to determine:
- How did the attacker gain access?
- Did they create persistence mechanisms, such as forwarding rules?
- What emails, files, or sensitive data were accessed?
- Are other accounts or systems compromised?
Time is of the essence. The longer it takes to answer these questions, the greater the risk. Attackers can wipe logs, move laterally, or escalate privileges while the investigation is still in its early stages.
Every Minute Wasted Increases Risk
A slow investigation process can have severe consequences:
- Attackers delete logs, move laterally, or create new persistence mechanisms.
- Compliance teams need detailed reports, but without timely access to evidence, security teams are left scrambling to piece together fragmented data.
- Incident responders struggle to quickly assess the full scope of the compromise, delaying containment and response and increasing organizational risk.
The Painful Bottleneck in Cloud Investigations
Despite being one of the most common cyber threats, BEC investigations remain frustratingly difficult to execute at speed. Incident responders must hunt for evidence across cloud platforms, often without a standardized approach.
Accessing Critical Evidence is Slower Than It Should Be
Most security teams do not have direct access to Microsoft 365 or Google Workspace admin panels. Instead, they must:
- Submit IT tickets requesting access to logs.
- Wait for approvals, sometimes for hours or days.
- Rely on IT teams to manually extract the data they need.
This dependency on IT delays investigations, giving attackers more time to maintain persistence, escalate privileges, or delete evidence.
Cloud Admin Consoles Are Not Built for Investigations
Even when access is granted, investigators face a series of challenges:
- Sign-in logs are buried under multiple layers of menus and only cover a limited timeframe unless retention settings have been manually adjusted in advance.
- Email forwarding rules, which attackers frequently use to maintain persistence, are stored in separate locations. There is no simple way to correlate when they were created or by whom.
- Audit logs exist, but they are not unified across services. Investigators must manually correlate timestamps from different sources, which slows down the process and increases the risk of missing key details.
Retention Policies Create a Race Against Time
Microsoft 365 and Google Workspace do not store logs indefinitely. If extended logging is not preconfigured, critical investigation data may already be gone by the time an incident is detected. Investigators who lack real-time access to cloud artifacts risk operating with incomplete evidence, making it harder to determine how deep the compromise goes.
Cloud Evidence Collection Needs an Evolution
To build comprehensive visibility, enterprise security teams need to simplify and centralize cloud evidence collection. That means:
- Eliminating manual gaps – A process that does not require investigators to rely on scripts, open-source tools, or complex admin panels.
- Focusing on the right data – Instead of overwhelming teams with raw data dumps, tools should allow and enable users to collect the key artifacts—emails, login events, admin actions—structured and ready for analysis.
- Standardizing and accelerating cloud forensics – Investigations should be as structured and repeatable as endpoint forensics, allowing teams to move quickly and consistently.
Introducing Tornado: A Faster, Smarter Way to Collect Cloud Evidence
Released as a preview version, Binalyze Tornado was built to eliminate the cloud investigation bottleneck, providing a faster, more efficient way to collect email evidence. It embodies Binalyze’s vision of scalable, comprehensive, and accurate incident response at speed.
- Investigator-friendly workflow – No more navigating complex admin panels or waiting on IT.
- Purpose-built for Microsoft 365 and Google Workspace – With more platforms to come.
- Seamless evidence export for deeper analysis – Once the evidence is collected, you can download it as an SQLite database or integrate with Binalyze AIR’s Investigation Hub for deeper analysis.
Tornado is now available as a free standalone tool. We’re just getting started, and your feedback will help shape its future. Download Tornado today, put it to the test, and be part of the evolution of cloud forensics.
