Consulting · Three practice areas
We don't run engagements from a deck.
Adaptive red-team operations, DFIR, and intel-led threat hunts. Every engagement is run by the same operators who teach the course and write the playbook. The deliverable is not a PDF; it is a capability your team carries forward.
Offensive · Adversary emulation
Adaptive Red Team Operations
Intel-led emulation against your crown-jewel assets.
Engagements scoped against the actor profile most likely to target you — not against a generic checklist. We map the campaign to your estate, run it long enough for blue to learn from, and walk through every step on debrief day.
- Threat-actor profile built from TTPs we see in our own intel
- Multi-week campaigns, not week-long pentests
- Detection-engineering debrief — what fired, what didn't, why
Defensive · Forensics & response
Digital Forensics & Incident Response
Retained or emergency. 90-minute activation SLA.
Court- and regulator-admissible artefact handling from minute zero. Same team that wrote your runbook activates it. Chain-of-custody discipline, four-stream evidence collection (disk · memory · network · log), and a reconstruction your audit committee can defend.
- Retainer with quarterly tabletop + on-demand activation
- CERT-In / RBI / DPDPA notification support in-loop
- Anonymised debriefs for your peer banks via IB-CART
Proactive · Hypothesis-driven
Threat Hunting
Hypothesis-driven hunts in your telemetry. We don't wait for alerts.
A hunt sprint starts with a named adversary or technique and ends with a sigma rule, a tuned detection, or a confirmed compromise. We work inside your SIEM and EDR — no agents to deploy, no data to ship out.
- Sprint engagements: scope, hypothesis, hunt, report — 2 to 6 weeks
- Programme retainer: hunt cadence, hypothesis backlog, hunter coaching
- Output mapped to MITRE ATT&CK and your own detection-coverage matrix
In an incident now
DFIR emergency activation. 90-minute SLA.
Same call to the same operator team — whether you're on retainer or have never spoken to us before. The first ninety minutes are scoping, containment, evidence preservation, and a CERT-In / RBI notification draft if you need one. Pay afterwards if the bridge holds.