determines that proprietary information is being stored in cleartext.

occurs during the monthly vulnerability scanning.

uncovers indicators of prior compromise over the course of the assessment.

proceeds in parallel with a criminal digital forensic investigation.