SCUT used controlled attack simulations at Orange Business Tech Now 2026 to show two common enterprise security scenarios: malware execution on a laptop and a phishing site reached through a QR code. In the mobile test, a protected phone blocked the phishing destination before its fake Microsoft sign-in form could load.
The laptop demonstration used a system protected by CrowdStrike Falcon. SCUT placed a malicious file and worm-like script inside an archive; one file was blocked when the archive was extracted, while execution of the script was stopped. An alert then appeared in the security operations center, or SOC, console after roughly a minute.
The exercise illustrated the distinction between a basic malware alert and endpoint detection and response. SCUT said its managed detection and response service combines endpoint protections, including offerings from CrowdStrike and SentinelOne, with continuous monitoring and analyst intervention. Its 24/7 MDR service collects data from endpoints, servers, cloud environments and firewalls in a unified platform.
During the demonstration, the analyst console exposed the context needed to investigate the attempted compromise rather than simply flagging a suspicious file.
- Hash of the suspicious file
- Command that was executed
- Affected computer and user
- Processes launched during the event
- Network activity
- Registry changes
- The full execution chain
- Relationships between processes
- A timeline before and after detection
Hackers do not take breaks. They work at night, during the day and on weekends, especially when people are less attentive.
SCUT representative
SCUT also demonstrated a co-management model in which both the SOC and the customer’s IT representative can access incident information. In the test, notifications were shown on a phone as well as in the operations console, allowing an organization’s own IT team to see an active event without waiting for a later report.
QR phishing is the mobile test case
The second scenario began with an unprotected phone scanning a prepared QR code. It opened a page designed to imitate a Microsoft authentication screen, complete with Microsoft branding and credential fields. The URL included the word “protected,” an example of how superficial cues can make a phishing page appear more credible.
Credentials entered on that page would have been sent to infrastructure controlled by Orange Cyberdefense for the attack simulation. No application installation or executable download was required: scanning the code alone directed the user to the fraudulent page.
Repeating the scan on a phone running Pradeo’s mobile security solution produced a different result. The connection was blocked before the form appeared, and the device displayed a “phishing detected” alert. SCUT’s management console subsequently recorded the URL and the device on which the detection occurred.
Pradeo says its Mobile Threat Defense offering can block malicious links distributed through QR codes, SMS messages, email and applications, alongside mobile malware detection. The comparison in the demonstration was limited to the controlled phishing link shown at the event.
SCUT said a detected malicious URL can be collected as an indicator of compromise and shared with other security systems. For example, the domain can be added to a company firewall blocklist, turning a detection on one employee’s phone into a protection rule for other devices across the organization.
SCUT’s portfolio also includes risk assessment, vulnerability management, threat hunting and incident response. The demonstrations focused on the earlier stage of that lifecycle: detecting a malicious action quickly enough to contain it before it can spread through an organization.
