Two paths through the same incident.
Without the Doppelgänger
- 1
Day 0
A vulnerability in a widely used plugin is published. The update is ready, but it is scheduled for “the next maintenance appointment” in six weeks.
- 2
Day 1
An automated scan finds the website and plants a hidden back door.
- 3
Days 2 to 7
Anyone coming from Google on a phone lands on gambling sites. On the office PC everything looks normal.
- 4
Day 8
A customer gets in touch. The host suspends the account because it is sending spam. Four more of the company’s websites sit on the same server, all of them infected.
- 5
Days 8 to 13
Analysis and rebuild. The host’s backups go back seven days and are already infected. Google shows “This site may be hacked”, and the review takes days to weeks.
The trust of customers who landed on a casino site, and weeks with a warning in Google.
With the Doppelgänger
- 1
24 to 48 h
The security update is tested on the copy and usually live within 24 to 48 hours, instead of after six weeks. That lowers the risk considerably, but not to zero: the most sought-after vulnerabilities are exploited after five hours on average.
- 2
Night 1
If there is a break-in anyway: the nightly file comparison finds the unexpected file the following night, and content validation finds the tampered pages.
- 3
Next morning
The last clean version is rolled out again (minutes), and the analysis runs on the copy, not on the live website.
Effort: a few hours instead of two weeks.
Today, the time between a vulnerability being published and the first attack is often just hours. A quarterly update can no longer keep up.
What the incident costs.
More case studies
Friday evening, “Update all”
One click on “Update all”, and after that the website showed nothing but “There has been a critical error.”
The checkout that listens in
For weeks, card details were skimmed at checkout. It was the bank that reported it.
The full disk
For two days the store took no orders. The disk was full, and nobody noticed.
A typical course of events, assembled from real incidents. Figures are example calculations based on the stated assumptions.