Cyber Security
Telemetry, detection engineering, triage and response - plus the unglamorous operational hygiene that decides whether an intrusion becomes an incident. Built around a data pipeline you control, so coverage and cost are engineering decisions rather than licence accidents.
What we deliver
Every engagement is scoped to your environment - deploy a single capability or the full stack.
A detection and response function sized to your risk, your telemetry and your headcount reality.
A platform that ingests what matters, at a cost you modelled before signing.
Round-the-clock analysis with contracted containment authority, not alert forwarding.
Automate the repetitive majority of triage so analysts spend their time on the cases that need judgement.
Endpoint telemetry and containment that reaches every host, including the ones nobody inventoried.
Detections written, reviewed, tested and versioned like software.
Structured search for the intrusion that has not alerted yet, driven by what actually targets your sector.
A named team, contracted response times, and a plan that has already been rehearsed.
Establish what happened, what left, and what must be reported - to an evidentiary standard.
The control that prevents most incidents, run as a service with a measured SLA.
Detect the misuse that looks like ordinary work until it is baselined.
Near-zero-false-positive signals from assets and credentials no legitimate user should ever touch.
Technical deep dive
Applies to any security operation whose platform bill grows faster than its detection coverage - the near-universal outcome of routing all telemetry into one licensed tier.
What this is
A telemetry pipeline in front of the analytics platform. Events are collected once, normalised to a common schema at the edge, then routed by value: high-signal data into the real-time detection tier, bulk data into cheap searchable storage, everything into archive with replay. Detections are written, reviewed and tested as code against that schema.
The problem being solved
Ingest has tripled in two years, driven by verbose cloud audit logs and endpoint telemetry. The licence is now the second-largest line in the security budget, and the response has been to stop onboarding sources - so coverage is shrinking while cost grows. Detection content is a few hundred rules edited directly in the console, with no version history, no test coverage and no owner; nobody can say which adversary techniques are covered, and roughly a third of the alert volume comes from a handful of rules everybody has learned to close without reading.
Why it is hard
Reference architecture - step through it
id: DET-0421
title: Cloud role assumed from an unusual network after token replay
owner: detection-engineering
status: production
technique: [T1550.001, T1078.004] # coverage is computable from this
data_sources: [cloud_audit, identity_signin]
schema_version: 3
logic: # written against the common schema,
window: 30m # not against one platform's fields
sequence:
- event: identity.token.issued
where: auth_method != "phishing_resistant"
- event: cloud.role.assumed
where: |
principal == prior.principal
and asn(source.ip) != asn(prior.source.ip)
and role.privilege_tier <= 1
emit:
severity: high
entities: [principal, role, source.ip]
tests: # CI refuses to deploy without these
- name: replay_from_hosting_provider
fixture: fixtures/aitm_replay.jsonl
expect: alert
- name: legitimate_travel_same_asn
fixture: fixtures/roaming_user.jsonl
expect: no_alert
- name: service_principal_normal
fixture: fixtures/ci_pipeline_assume.jsonl
expect: no_alert
false_positive_budget:
expected_per_week: 3
breach_action: ticket_to_owner # not "analysts absorb it"
response:
playbook: PB-IDENT-CONTAIN
auto_actions: [revoke_session, revoke_refresh_token]
gated_actions: [disable_principal] # human approves anything destructiveMeasured change
| Measure | Before | After |
|---|---|---|
| Sources onboarded | frozen - cost-constrained | all in scope, tiered by value |
| Real-time tier volume | 100% of telemetry | 18% - the detection-relevant fraction |
| Detections with automated tests | 0 of ~300 | 100% - CI blocks untested rules |
| Technique coverage, measured | unknown | published and tracked per release |
| Alert volume from the top 5 noisy rules | 34% of queue | under 4% after budgeting |
Coverage and cost stopped being the same conversation. Detection became a codebase with owners, tests and a changelog - which is what makes it possible to delete a rule, not just add one.
Schedule a free consultation and our team will connect within 12 hours to understand your environment and map out the right approach.
We respond within 12 hours