What a Data Breach Looks Like From the Inside
A breach rarely announces itself. What you see first are anomalies. By the time it's obvious, the damage is done. Here's the sequence of what actually shows up in your logs.
1:26
Transcript
Most founders think a breach looks like a ransom note. It doesn't. It looks like a login at 3am from a location you've never seen. Then an export job nobody scheduled. By the time it's obvious, it's been happening for days.
Watch the log sequence. It starts normal. Then an auth token is reused from an unexpected location. A read query scans the full user table — not a pattern you'd see in normal product usage. Then a spike in export API calls. The alert fires. By then the exfiltration has already happened. Incident response kicks in: rotate credentials, isolate the affected service, begin forensics. Every minute from the first anomaly to containment is measured.
Here's the blast radius. The attacker got through the auth service first. From there they had read access to the user database and the API gateway. That exposed payment data and email records. The log service captured it — but the alert came too late to prevent the initial exfil. This is why blast radius design matters before a breach happens, not after. Least privilege, segmented services, automated alerts at anomaly — not at confirmation.