The impact of an incident is often unknown until we enter into the aftermath.  How it happened can't always be answered but the goal post incident is to determine what can be done to prevent this in the future.  How do we prepare to reduce the impact of a future event when we don't know in advance what that event might be?  Join me as Chad Holstead and I revisit an all to recent event and how his team was able to piece together the events that led up to a user in the client company having their identity compromised with O365.  I learned a lot on this one and i hope you learn something from Chad's experience as well.