Entry watches vs Damage watches

Account compromise has two halves, and Clicc watches both.

Entry watches - someone getting in

• Pending access invite - the earliest signal, before access even exists.

• New user / access change - a person gains access, or an admin role appears.

• New manager link - an unfamiliar MCC gains bulk control.

All three run every 5 minutes against your trusted baseline.

Damage watches - what an intruder does inside

• Critical setting change - budgets jacked up, targets shifted, campaigns paused.

• Runaway spend - the money actually leaving.

• Conversion tracking broke - tracking tampered with to hide the damage.

Example. A real takeover reads like a sequence: pending invite (5:02pm) → new admin user (5:20pm) → budget +400% (5:31pm) → runaway spend (6:15pm). Clicc emails at every step - you almost always act on the first one.