Email domain
Attempt
Mail impersonating your company
Sender not authenticated: SPF and DKIM checks fail.
Stopped by
DMARC p=reject – the receiving server rejects it.
Attackers hunt for gaps. We close them first.
Northwestern Tideline – managed cybersecurity for the age of AI: website, email, accounts, network and backups.
Illustration: typical attempts and the control that stops each one.
- Email domain
Attempt
Mail impersonating your company
Sender not authenticated: SPF and DKIM checks fail.
Stopped by
DMARC p=reject – the receiving server rejects it.
- Accounts
Attempt
Sign-in with a leaked password
Correct password, but a new device and location.
Stopped by
MFA required – no access without the second factor.
- Accounts
Attempt
Legacy mail sign-in
Older protocols do not ask for a second factor.
Stopped by
Legacy methods switched off; modern sign-in with MFA only.
- Website
Attempt
A known plugin flaw
The flaw is public and a fix is already released.
Stopped by
Plugin updated within the agreed window – flaw closed.
- VPN
Attempt
Mass sign-in attempts
Hundreds of password attempts per hour.
Stopped by
Current firmware, MFA and attempt limits.
- Backups
Attempt
Ransomware going after backups
Attackers first try to reach backups on the network.
Stopped by
A separate, immutable copy and a tested restore.
- PHP
Attempt
A site on unsupported PHP
PHP 8.1 security support ended on 2025-12-31.
Stopped by
Moved to PHP 8.3 or 8.4, tested.
In recent months
A flaw is published in the morning. Within hours, someone is trying it.
Northwestern Tideline closes the door before anyone knocks.
What the latest data shows
Public figures, each with its source and date. Not forecasts, not our estimates.
- of Lithuanian websites run on PHP. The national cyber centre urges updates for critical flaws: only updating removes the risk.
- ~80%
- NKSC (LT), 2026-10-22
- fine for a clinic chain after a ransomware attack. The regulator noted multi-factor authentication was not used.
- €450,000
- VDAI (LT), 2026-06-26
- of ransomware attacks start with a compromised identity. In 97% of those, MFA existed somewhere, just not everywhere.
- 79%
- Sophos, 2026-07
- people in Lithuania affected by cyber incidents in personal-data breaches, H1 2026 (75% of all affected).
- 1,235,050
- VDAI (LT), 2026-07-16
- leaked Lithuanian login credentials found in open and closed sources; 221 organisations were warned.
- 106,000+
- LT Ministry of Defence, 2025 review, 2026-06
- cloud customers could recover data after the ransomware attack on IDC Frontier. The rest relied on their own backups.
- 194 of 495
- BleepingComputer, 2026-10
How money is usually lost
Not a movie hack: four ordinary steps. Upkeep stops each one.
- 1
A leaked password
An employee’s password ends up in a leaked credential set, or is phished by email.
MFA on every account, no exceptions
- 2
A silent mailbox rule
The attacker signs in and creates a rule that hides customer replies.
Review of suspicious rules and sign-ins
- 3
A forged invoice
A customer receives an "updated" invoice with new bank details, apparently from your address.
DMARC, so spoofed mail is rejected
- 4
The money leaves
The payment is made; it is noticed weeks later.
An incident plan with clear actions within 24 h
Typical scenario. Scenario generalised from publicly described Microsoft 365 campaigns and national warnings about email fraud.
It has already happened to companies here
Publicly reported cases from recent months.
Clinic chain: €450,000 fine
Ransomware encrypted four systems holding patient and staff data. The regulator found no multi-factor authentication and unrestricted access.
VDAI (LT), 2026-06-26Vilnius hotel: about 74,000 files published
After the ransom went unpaid, ID data of more than 500 guests and staff payroll documents were made public.
LRT (LT), 2026-10-02Tour operator: data on a black market
Lithuanian travellers’ data was reported on a Russian black market; law enforcement and the data regulator were asked to investigate.
LRT (LT), 2026-10-21None of these needed an exotic exploit: an account without a second factor, an unpatched system, backups nobody had tried to restore.
The clock is already running
Dates that apply to most companies with a website or NIS2 duties.
- 2026-12-31
PHP 8.2 security support ends
After this date new PHP 8.2 flaws get no fixes. Sites need to move to 8.3 or 8.4 and be tested.
php.net, 2026-10-22 - 2027-04-17
NIS2 technical requirements (LT)
For companies registered as cybersecurity entities in April 2025: 24 months from registration to implement the technical measures.
NKSC (LT), 2026-10-22 - 24 h / 72 h
Incident reporting
NIS2 entities owe an early warning within 24 hours and a notification within 72. Without a prepared plan, that is close to impossible.
LT Cyber Security Law, 2026-07-04
What Northwestern Tideline looks after
The six ways into a typical mid-size company. We assess each, fix it and keep it current.
01 / 06
Website, PHP and CMS
WordPress, WooCommerce, PrestaShop or others: core, plugins and PHP version updated within an agreed window.
- PHP version and support date
- Plugin and theme state
- Admin accounts and remote-management keys
What you get in the first two weeks
The check does not end with "all fine". It ends with documents you can show your board, auditor or insurer.
Book the check- 01
A prioritised list
Every gap with its risk, deadline and owner.
- 02
Email domain plan
SPF, DKIM and DMARC: who sends in your name and how to shut out impersonation.
- 03
Account report
MFA coverage, admins, legacy sign-in methods, suspicious rules.
- 04
Restore test record
How long a restore took and what was missing.
- 05
NIS2 applicability memo
Whether it applies, why, what to do and by when, with sources.
- 06
A call with management
30 minutes without jargon: what matters most and what it costs to fix.
How we work
Tideline weekly summary
Company, 60 staff · 1 week
- WebsitePHP 8.1, 6 plugins outdated
- Email domainNo DMARC
- AccountsMFA 41 of 44
- VPNFirmware 14 months old
- BackupsRestore never tested
- NIS2Unclear if it applies
Illustration of the management report. Not client data.
- 01
Security check
Fixed scope, about two weeks. Written authorisation before any access. Output: a prioritised gap list with deadlines, labelled as an assessment.
- 02
Hardening
The most important gaps closed within an agreed window: MFA, PHP and CMS updates, DMARC, backups, device firmware.
- 03
Continuous upkeep
Weekly updates and checks, a monthly report for management. NIS2 evidence built continuously, not the week before an audit.
Five questions for the person in charge
Answer for yourself. Your answers stay in your browser and are not sent anywhere.
- 01
Does every company mailbox, including admin and shared ones, require a second sign-in step?
- 02
Do you know which PHP version your website runs, and whether it is supported after 2026-12-31?
- 03
Does your domain publish a DMARC policy that rejects forged email?
- 04
In the last six months, has anyone actually restored data from a backup?
- 05
Do you know whether NIS2 applies to your company and whether you must register in KSIS?
What we do not do
- We never test any system without written authorisation.
- We do not scare with invented threats or promise "100% security".
- We do not claim certifications we do not hold. Where one is needed, we bring a certified partner and say so up front.
- We do not represent NKSC or any authority. KSIS registration is done by the company head; we help you prepare.
Questions
Does NIS2 apply to us?
It depends on sector and size (headcount and financial thresholds under the Lithuanian Cyber Security Law, or your country’s transposition). The check assesses it from your data, with sources.
Can you register us in KSIS?
No. Only the company head can sign in to KSIS. We prepare every piece of data and document so registration takes minutes.
How is this different from our IT administrator?
Your administrator keeps things running. Northwestern Tideline keeps what runs patched, protected and proven, with deadlines, reports and NIS2 evidence.
Will we need to replace systems?
Usually not. We work with what you have: Microsoft 365 or Google, your current website and devices. We only propose replacing what is no longer supported.
What does it cost?
We do not publish a price list. The check has a fixed price and scope; upkeep depends on the number of systems. We reply within one business day.
Start with what is open today
Leave your website and email. A person replies within one business day with a proposed scope. We do not test your site until you give written authorisation.