Portfolio

Selected outcomes from teams that applied TraceFoundry playbooks after class. Names are anonymized where requested.

Enterprise IT department

Faster host triage after identity alerts

Challenge

Repeated alerts produced long ticket threads but little structured evidence, slowing coordination between the service desk and security.

Approach

TraceFoundry trained a joint cohort on Endpoint Evidence Studio timelines and correlation markers, then embedded the workbook into their internal runbook.

What shifted

Handoffs now include a one-page artifact index, and duplicate queries dropped within the first operational month after training.

Managed service provider

Cloud pivot map for platform engineering

Challenge

Analysts and SREs spoke different dialects when reviewing audit exports, causing churn during busy release weeks.

Approach

Cloud Trail Reconstruction Lab sessions paired the teams with shared narrative checkpoints and leadership recap templates.

What shifted

Post-incident reviews cite clearer pointers to configuration drift and fewer reopen loops during reconciliation syncs.

Technical training coordinator

Respectful mailbox investigations

Challenge

Internal investigations needed tighter language and scope discipline when summarizing sensitive communications.

Approach

Mailbox Storylines for Analysts introduced header drills and cautious phrasing patterns aligned to their quality standards.

What shifted

Reviewers saw fewer speculative claims in early drafts, and messaging administrators reported cleaner escalation packets.

Enterprise IT department

Tabletop cadence for insider-adjacent signals

Challenge

Leadership updates during sensitive weeks sometimes contradicted each other because decision logs were informal.

Approach

Insider Case Tabletop Intensive established a repeating quarterly format with structured decision logs and calm tempo drills.

What shifted

Status threads shortened, and stakeholders could trace which facts were confirmed versus still pending.

Managed service provider

Lab footprint IT could maintain

Challenge

A forensic lab proposal looked impressive on paper but ignored patch windows and spare hardware realities.

Approach

Forensic Lab Foundations for IT reframed the design around tiered access, maintenance owners, and staged upgrades.

What shifted

The architecture brief passed internal operations review without a redesign cycle.