Western Aircraft’s IT team used CyberFOX AutoElevate to rethink how they handle local admin rights across nearly 400 employees and 500–600 endpoints.

Previously, they made “almost everybody in the company a local administrator” so staff could install the tools they needed. This created a significant security gap. With AutoElevate in place, they were able to:

• Remove standing local admin rights for almost all users.
• Route elevation requests into their ticketing system whenever someone needs to install software or perform an admin-level task.
• Approve or deny requests in minutes, without visiting the user’s workstation.

Routine tasks, such as adding a printer, now run automatically based on pre-approved rules. Anything outside those rules is blocked and sent to IT for review. This setup lets Western Aircraft lock down desktops while keeping employees productive, instead of forcing them to wait on IT for every small change.

Western Aircraft’s deployment of CyberFOX AutoElevate was tested during a real social engineering incident that could have led to ransomware.

Here’s what happened:

• An employee was contacted on Microsoft Teams by someone pretending to be internal IT support.
• The attacker convinced the employee to allow a remote session that lasted about nine minutes.
• The attacker disguised file transfer software as a Windows update and installed it on the machine.

Two security layers made the difference:

• The managed Endpoint Detection and Response (EDR) solution flagged the endpoint as high risk and isolated it.
• AutoElevate’s Blocker rules prevented the malicious software from ever running, even though it had been installed.

Using AutoElevate audit logs, the IT team could see exactly what the attacker tried to do. According to Senior IT Manager Steve Jackson, without the combination of EDR and AutoElevate, they likely would have been facing a ransomware incident. Instead, they contained the threat before data could be stolen.

The event also prompted Western Aircraft to:

• Close additional gaps in their Microsoft environment.
• Roll out new user security training focused on social engineering.

For Western Aircraft, CyberFOX AutoElevate has become part of their everyday security and operations strategy, not just a one-time incident response tool.

Key ongoing benefits include:

• Consistent control across nearly 600 computers: The IT team has a clear, centralized way to manage privileged access for 500–600 endpoints.
• Built-in protection against internal and external threats: AutoElevate helps ensure that, whether it’s an outside attacker or a disgruntled employee, they “are not going to be able to execute and do malicious things in the environment.”
• Two-in-one functionality: As IT Systems Administrator Jeremy Graham notes, AutoElevate acts as both a privileged access management (PAM) tool and a set of Blocker rules that automatically stop software commonly used by attackers.
• Operational efficiency: Routine, low-risk actions (like adding printers) are automated through approved rules, while anything unusual is blocked and routed to IT via tickets.

Over time, Western Aircraft has also expanded its CyberFOX stack, adding CyberFOX Password Manager and CyberFOX DNS Filtering alongside AutoElevate. Together, these tools help them reimagine how they balance user productivity with security, giving the IT team more visibility and control without putting unnecessary friction on employees’ day-to-day work.