Incident response & cyber preparedness — IT · OT · IoT
When an incident strikes we go past the visible threat and unravel the entire chain — how they got in, what they touched, and what would let them back. Containment is not the finish line.
4 hours
Assured response time from first contact, 24/7.
+100k
Hours in research and DFIR expertise.
~85%
MTTR reduction may be achieved with our IR team.
6
Open-source DFIR tools published and maintained.
Defence · energy · finance · critical infrastructure · national cyber bodies
Anatomy of an incident
The night of the incident is the part everybody remembers. The work that decides how it ends happens on either side of it.
Act one
A log source that was never enabled. An OT segment the EDR does not reach. An escalation path routed to someone who left last year. None of it announces itself, and all of it surfaces at the worst possible hour.
Cyber Preparedness — find it on a quiet Tuesday, for a fraction of the cost.
Act two
First contact starts the clock. Remote memory capture begins immediately, because the evidence that answers the hardest questions is the evidence that disappears first. Containment is planned against the actor, not the alert.
Emergency IR — assured four-hour response, 24/7, remote acquisition from minute one.
Act three
Most incidents are closed at the symptom and recur a month later. We stay through eradication, verify the access path is genuinely shut, and feed what we learned back into your detections.
T3aaS — senior escalation and continuous hunting, so the same class of alert closes itself next time.
New — agentic incident response
Automated Threat Hunting & Evidence Neutralization Architecture
Nine specialist agents work your case in parallel from the moment it opens — triage, memory forensics, reverse engineering, hunting, timeline and intel, all at once. Every action that would change your environment still waits for a named responder. The agents do the hours; our people make the calls.
No agent contains, isolates or deletes anything without a named responder approving it first.
9 models
One per agent. Model diversity eliminates systemic blind spots.
Parallel
Nine workstreams advance at once instead of queueing behind one analyst.
SHA-256
Chain of custody on every artefact, with read-only evidence enforcement.
0
Actions taken on your environment without a named human approving them.
What we do
Most organizations discover the gaps in their readiness during an incident, when the cost of finding them is highest. We front-load that work — and we are still there at 3am when it matters.
01
Readiness engagement
Most organizations discover the gaps in their readiness during an incident, when the cost of finding them is highest. Cyber Preparedness front-loads that work: we map what you actually have across IT, OT and IoT, establish the visibility and access an investigation depends on, and rehearse the response until it is routine rather than improvised.
More on this → Cyber Preparedness02
Ongoing retainer
Tier 1 and Tier 2 handle volume; the hard cases escalate. T3aaS gives you that senior escalation tier on demand — the reverse engineers, threat hunters and forensic analysts who resolve the alerts nobody else can close — without carrying the headcount full time.
More on this → T3aaS — Tier 3 as a Service03
24/7 emergency response
Neutralizing what you can see is not containment. Our incident response engagements run the full chain — detect, contain, eradicate, recover — and do not close until we understand how the actor got in, what they touched, and what would let them back. Assured response within four hours of first contact.
More on this → Emergency Incident ResponseHow it works
Reduce MTTR
Clear visibility, comprehensive system details, pinpointed vulnerabilities, and ready-to-act permissions for instant response.
Proactive measures, effective controls and functionality — plus exercises and simulations that let your team handle incidents confidently when they arise.
Time to act
Detect, contain and recover. We analyze every angle, eliminate the immediate threat, and meticulously unravel the entire attack chain.
Proof, not testimonials
The analysts on your retainer are the same team that tracks state-sponsored actors and ships the open-source DFIR tooling below. What we see in the field shapes the hunts we run for you.
M365 forensics
The M365 Analyzer & Extractor Suite — extract, analyze and preserve evidence from Microsoft 365 tenants with SHA-256 chain of custody.
Fortinet forensics
Open-source framework giving security teams the tooling they need for forensic investigations and incident response in Fortinet environments.
Prevention
Detects and blocks ransomware and wipers early in the infection chain, where built-in OS defenses fall short.
Cloud posture
CLI assessment framework for evaluating and monitoring an organization’s Cloudflare security posture.
Evidence capture
Chrome/Chromium extension enabling forensic-grade audit log extraction. Now at v2.0.
Compliance
Browser-based open-source checker helping Israeli organizations implement the requirements of Amendment 13 to the Privacy Protection Law.
Bridge the gap
Six capabilities you can take individually or as part of a retainer.
Be Ready
Practical, scenario-driven training that prepares your team for real-world incidents.
Get Set
Comprehensive assessment to identify and address security gaps before attackers exploit them.
Fast Response
Proactive monitoring and threat hunting to detect threats before they escalate.
Be Ready
Simulated incident scenarios to test your response readiness and improve coordination.
Get Set
Continuous security operations support to maintain your defensive posture.
Fast Response
Deep-dive forensic investigation to unravel the full attack chain and prevent recurrence.
We will tell you honestly which of these you need first — and if the answer is none of them, we will say that too.
Assured response within four hours of first contact.
