PasswordlessPhishing-resistantZero Public IPAudit-ready

Bastion Host + Facial Sign-In
Traces a Ransomware Hacker to Justice

How a mid-sized Canadian investment firm used Axiam's Bastion Host with liveness-verified Facial Sign-In to block an intrusion, produce court-ready identity evidence, and enable prosecution — without paying ransom.

Impact Summary
$1.54M
Avg. ransom avoided / incident
23 Days
Downtime avoided
+12%
Client acquisition post-incident
5 Years
Sentence of offender

* Benchmarks & internal analysis; customize per client.

Customer

FTBC Capital

A Canadian investment management firm overseeing $1B AUA. Targets of repeat ransomware attempts by the ShadowCrypt group.

Challenge

  • Prevent privileged access compromise without relying on passwords/MFA.
  • Eliminate exposed network surfaces (no public IPs, no brute-force).
  • Create non-repudiable identity evidence to support prosecution.
Incident Timeline

How the attack unfolded — and failed

T-0

Spear-phish attempt

Malicious link clicked; credential harvesting fails — no passwords exist.

T+1h

Blocked Brute-Force

SSH/RDP scans hit bastion; biometric gate stops sessions pre-auth.

T+2h

Insider Assist Fails

Liveness challenge records attacker's face at insider device.

T+2d

Law Enforcement

Audit video + device/geo metadata shared with RCMP cybercrime.

Evidence Pillars

From anonymous incident to prosecutable case

Pillar 1

Biometric Audit Trail

Liveness check captures attacker face; tamper-evident video hash archived.

Pillar 2

Attribution Metadata

Device fingerprint + IP/geo context correlated with existing case files.

Pillar 3

Court-Ready Exports

Time-stamped session logs + chain-of-custody package for prosecutors.

Results

Zero ransom. Zero downtime. Full justice.

$0
Ransom Paid
0h
Service Downtime
-0.0%
Customer Churn
5-year sentence
Offender Outcome
"

With Axiam's Bastion + Facial Sign-In, there were no credentials to steal and no public IPs to probe. The audit video made the difference — turning an anonymous incident into a prosecutable case.

— CISO, FTBC Capital

Figures are representative; update with your verified metrics.

Architecture Snapshot

Three layers. Zero attack surface.

Client Device

  • Camera + liveness prompts
  • Face template encrypted on device
  • No secrets stored locally

Axiam Bastion

  • Face-verified token issuance
  • Policy/segmentation enforcement
  • SIEM/SOC streaming

Protected Resources

  • Servers • VPN • DB • Apps
  • Privileged access only
  • Full session recording
Bring Verified Identity to Your Perimeter

Retire passwords and weak MFA.
Gate every privileged session with a verified face.

Phishing/MitM resistant
No keys to manage
No public IP exposure
Court-ready audit trail
Request Demo