Seven disciplines. One evidence base.
Counter-reconnaissance, hunting, fusion, exposure, active defence, forensics and sensor health — each page states the operational problem, the workflow, the data it uses and the trust boundary.
Counter-reconnaissance and behavioural detection
Recognise the preparation before the attack: systematic enumeration, scheduled sweeps of many properties by one source, returning observers and automation presenting as people.
Available in current prototypeThreat hunting and historical investigation
Ask a new question of old evidence. Replay any past window, follow a source back through weeks of history, and test a hypothesis before acting on it.
Available in current prototypeIntelligence fusion and relationship discovery
Join observations that no single log connects: different networks, different servers, different weeks — linked by what they share, each link carrying its own confidence.
Available in current prototypeAttack-path and exposure analysis
See the environment the way an adversary would: what is reachable, what is misconfigured, and which short chains of weaknesses lead to what matters.
Available in current prototypeActive defence and controlled interdiction
Guarded, reversible, auditable responses — throttle, challenge, refuse, isolate, revoke — inside infrastructure the customer controls and within a policy the customer approved.
Available in current prototypeForensics, evidence integrity and reporting
Evidence that survives scrutiny: append-only records, integrity baselines, correlation around every trigger, and reports a non-specialist can act on.
Available in current prototypeSensor reliability, tamper detection and operational health
A monitoring system must notice when it goes blind. Sensor silence, tampering and degraded coverage are findings in their own right.
Request a technical briefing
Tell us what you need to protect. A briefing is an engineering conversation; it never needs your credentials, network inventories or logs.