Containing an overnight IRSF loop in four minutes

Kestrel's verification service used a shared credential across staging and production. When the credential leaked, an automated loop began placing calls to international premium-rate ranges overnight, when nobody was watching.

Under their previous provider this would have surfaced on the monthly invoice.

Per-destination baselines had been running for three weeks, so the platform already knew what normal looked like for the account. Traffic to a destination Kestrel had never called before, at a volume they had never sent, tripped the anomaly threshold immediately.

A hard per-destination hourly spend cap stopped the traffic at the session border controller rather than waiting for a nightly reconciliation job.

The loop was blocked four minutes after it started. Total exposure was under £400 against a modelled worst case of roughly £46,000 by morning. The incident timeline gave Kestrel's risk team everything they needed for their own post-mortem.