Welcome to Agentic Security & MFA thatrotates a phished credential before the attacker uses it.
A three-person team cannot watch forty thousand accounts by hand. Risely runs the mechanical containment the minute a report lands and chases every enrolment gap by name. The security team takes the judgment calls.
Containment · from one student's report
minute 0
Credential rotated
the reported account, first
Sessions ended
everything the old password still owned
Sender blocked at the gateway
so the next copy never lands
The rest of the radius warned
everyone who received the same lure
The rest of the radius
A staff mailbox
exposedA faculty mailbox
exposedA student mailbox
exposedA shared office mailbox
exposedA second student mailbox
exposedA mailbox that already clicked
exposed
Coverage is a list of names, and a percentage is not.
Risely's agents take the enrolment number apart. The 47 accounts still open become 31 new adjuncts whose onboarding now carries enrolment, and 16 people who each get chased until the list is empty.
Coverage, as a list
counting
Enrolment coverage
99.1%the number the dashboard shows
47 accounts still open
the part that mattersattackers look for exactly these
31 new adjuncts
enrolment drafted into onboardingso the gap closes at the source
16 chased individually
each one a message and a deadlineuntil the list is empty
A coverage percentage hides the accounts an attacker is looking for. A list names them.
A student who reports a message is the fastest sensor on campus.
Risely's agents read the report and the headers, start the mechanical containment straight away, and write back to the person who sent it. Reports keep arriving when reporting visibly does something.
One report, end to end
working
A student forwards a suspicious message
one button in the mail client
Risely reads the message and the headers
the sender, the lure, the link
Containment starts on the mechanical part
before anyone opens a queue
The reporter hears back
what it was, and what happened next
People stop reporting when reports vanish. Answering the reporter is what keeps the next message coming in.
An alert closes with its explanation attached.
Risely's agents challenge the sign-in, record what answered, and write why the anomaly was safe. A detector that cries wolf gets ignored on the morning it is finally right.
One risky sign-in
checking
Impossible travel flagged
a faculty account, two countries in an hour
Challenged at the next request
a factor the traveller has to hold
Verified legitimate
a remote access session explains the location
Closed with the explanation
on the record, where the next alert can read it
An anomaly detector that cries wolf gets ignored on the day it is right, so every closure carries the reason it was safe.
The calls that end someone's access belong to a person.
A forwarding rule created overnight, a sign-in from a country nobody travels to. Risely's agents finish the mechanical work, attach the evidence, and put a short list in front of the security team.
Waiting on the security team
with the evidence attached
A mailbox rule that forwards off campus
it appeared last night on a faculty account
A sign-in from a country the campus does not work in
the record shows no travel and no session to explain it
Risely's agents finish the mechanical work and hand over the calls that end someone's access. A three-person team gets a short list rather than a log.
One thing moves. The containment re-runs.
A second report, a sender address nobody had seen, a mailbox that clicked an hour ago. Any of them widens the incident, and every one runs the same way.
A second report names the same lure
a different sender address
Risely widens the match
both addresses in one campaign
The radius recomputes
everyone who got either message
The rotations run again
on the accounts the widening added
One incident holds both reports
with every action on the trail
What changes, and how it runs.
The stolen credential dies early
Containment runs before anyone opens a queue.
The enrolment gap has names on it
Risely chases each straggler until the list is empty.
The team works the real threats
Risely finishes the mechanical steps before they arrive.
The technical read
Connects read-only to your identity provider, mail gateway, and sign-in logs to start
The security team decides anything that ends a person's access
Every action lands on an append-only log
Runs alongside what you have. Nothing rips out.