- Home
- Services
Every service, grouped
by the problem you have.
Seven categories, the way buyers describe their situation. Each has a specialist bench behind it, and each links to the next thing you will need.
Managed Detection & Response
Someone watching your systems around the clock, reading the warnings and acting on them.
MSOC, autonomous SOC
36 AI employees, sub-2-minute detection and response. Replaces SIEM + SOAR + SOC. Live in 21 days.
Learn more →Managed SOC, human-in-the-loop
MSOC delivered as a managed service, autonomous or human-in-the-loop. Sub-2-minute detection, residency built in. Talk to sales.
Learn more →MDR, your EDR run by us
MSOC applied to your existing EDR. We manage it day to day, automate the response behind confidence gates, and answer for the outcome. Talk to sales.
Learn more →SIEM
SIEM deployment, tuning and detection content: 500+ pre-built log sources and 100+ use cases, on your platform or ours. Scope it with an engineer.
Learn more →SOAR
SOAR that acts on your warnings: playbooks written during real incidents, every action logged and overridable, on your platform or ours.
Learn more →Threat Intelligence
Know what is coming before it reaches you, your name, domains and credentials watched where criminals trade them.
MÍMIR intelligence
MÍMIR threat intelligence and MTAC analysts: indicators with context, attribution and confidence, scored to your estate. Talk to sales.
Learn more →Threat intelligence service
Threat intelligence delivered as briefings with a recommended action, not a raw feed. Nothing touches your network. Talk to sales.
Learn more →Darknet & leak-site monitoring
Continuous darknet and ransomware leak-site monitoring for your credentials, data and access, with a recommended action on every alert.
Learn more →Executive & brand protection
Monitoring for leaked personal data, family exposure and travel risk for named executives, plus brand impersonation. Talk to sales.
Learn more →THRUD, Web3 threat detection
THRUD watches new smart contracts as they deploy, flags honeypots and rug pulls, and links each contract to the wallets behind it. Analyst-backed.
Learn more →CVE & KEV tracker (live)
Live exploited-CVE and KEV exposure tracker. Open to everyone.
Learn more →Offensive Security & Hunting
Find the gaps before an attacker does, hunt for intruders already inside, and test your defences on purpose.
Threat hunting
Analysts hunt your own systems for intruders no alarm has flagged, on the tools you already own. Backed by 1,700+ playbooks across 19 platforms.
Learn more →Penetration testing, Ragnarök
With written permission we attack you the way a criminal would. Every finding carries proof, a severity and a fix, and the re-test is included.
Learn more →Red team
Goal-driven adversary simulation run without warning your defenders. We pick an objective, reach it with stealth, and map every step to what you detected.
Learn more →Purple team
We run adversary techniques step by step while your team watches its own tools. Every detection gap is found, fixed and re-tested the same day.
Learn more →Blue team & detection engineering
Detection engineering, SOC optimization and alert tuning on the tools you already run. Fewer false positives, better ATT&CK coverage, clearer runbooks.
Learn more →Cyber war gaming, Vigriðr
We build a copy of your environment, run real ransomware inside it, and have your executives decide under pressure. Full after-action reporting.
Learn more →Tabletop exercises & playbooks
Vigriðr tabletop exercises and incident response playbooks, written by responders for your tools and team, then tested in a facilitated exercise.
Learn more →Phishing simulation
Controlled phishing, smishing and pretext campaigns with click, credential-entry and report rates by department, plus targeted training.
Learn more →Ransomware readiness
A scored assessment of backups, segmentation, privileged access, detection and first-six-hours decisions, ending in a prioritized fix list.
Learn more →Incident Response & Forensics
The team you call when it goes wrong, contain it, work out what happened, rebuild what broke.
Mjolnir Response, incident response
24/7 incident response across the GCC and Asia. Rapid containment, ransomware, forensics. 600+ engagements. Retainers with response from 1 hour.
Learn more →IR retainer, Shield, Fortress, Valhalla
Incident response on retainer. Agreed terms, guaranteed response from 4 hours down to 1 hour, and readiness work. Tiers: Shield, Fortress, Valhalla.
Learn more →Bifrost, digital forensics
Court-admissible digital forensics. Credentialed examiners, chain of custody, expert testimony. Computers, cloud, mobile. Group SOC 2 Type II.
Learn more →Mobile forensics
iOS and Android forensics: deleted messages, location history, app data and spyware detection. Consent-based extraction in 15 to 30 minutes.
Learn more →EIR, sensitive-data discovery
EIR finds where your sensitive data lives across SaaS, cloud, databases and file servers, tells you who to report to, and escalates critical finds to MSOC.
Learn more →Mjolnir Shield, post-incident rebuild
Mjolnir Shield rebuilds after an incident: clean systems, close what let them in, reset identity, harden and monitor, with the restored posture documented.
Learn more →Crisis management
Cyber crisis management: an experienced crisis commander, a command structure, crisis communications with PR counsel, and a framework tested in advance.
Learn more →Service continuity
Business continuity and disaster recovery for cyber-era disruption: business impact analysis, continuity and DR plans, RTO and RPO testing, and exercises.
Learn more →Digital Evidence & Legal
Evidence that stands up in court, collected properly, and testified to.
eDiscovery
Defensible eDiscovery from legal hold to production: forensic collection, de-duplication, AI-assisted review and multilingual recognition with handwriting.
Learn more →Anton Piller order support
The forensic team on the day of an Anton Piller order. We image devices and preserve cloud data defensibly, alongside the supervising solicitor.
Learn more →M&A cyber diligence
Passive cyber diligence on an acquisition target in 5 to 7 business days: darknet exposure, attack surface, signs of compromise. Never touches its systems.
Learn more →TYR evidence platform
TYR, our digital evidence platform: evidence packaging, a tamper-evident audit trail, chain of custody and court-ready documentation.
Learn more →Assessments & Advisory
Know where you stand, and get help closing the gap, reports, a borrowed security lead, and the architecture to back it.
Compromise assessment
Is someone already inside? A deep forensic sweep of every endpoint, first findings in 24 hours, with a remediation playbook. Fully remote.
Learn more →Vulnerability assessment
Every asset found and scanned inside and out, findings validated by an analyst and ranked by real risk, with fix guidance and a re-scan to confirm.
Learn more →Gap assessment
Your controls mapped to NIST CSF, ISO 27001, CIS and the rules you answer to, gaps ranked by business impact, with policies and a phased roadmap.
Learn more →Microsoft security assessment
Every Microsoft 365, Entra ID, Intune and Defender control examined and mapped to recognised standards. Two weeks for one tenant, re-baselined quarterly.
Learn more →vCISO
A senior security leader on an annual contract at four, eight or twenty hours a week: policy, compliance, board reporting and a roadmap you can fund.
Learn more →Fandral staff augmentation
Credentialed security analysts embedded in your team in as little as 48 hours, for risk, audit, compliance, incident response and intelligence work.
Learn more →GRC & compliance, Forseti
SOC 2, ISO 27001, PCI DSS, UAE PDPL, NCA ECC and SAMA CSF run to a deadline, controls, evidence and audit support, not just a gap list.
Learn more →Cyber insurance support
Help on both sides of the policy: accurate insurer questionnaires, closing the gaps that drive premiums or refusals, and claim-ready forensic evidence.
Learn more →Supply chain & third-party risk
Vendors inventoried and tiered by access, each checked for external and darknet exposure, with questionnaires, contract terms and continuous monitoring.
Learn more →Secure Your Future, SaaS security
Gap assessment plus continuous SaaS security monitoring: a roadmap for your programme and live visibility across Microsoft 365, Salesforce and more.
Learn more →Center of Excellence programme
A full security transformation in six phases over six to twelve months, against a three-to-five-year roadmap, with your own capability built as we go.
Learn more →Architecture & Hardening
The architecture that backs the assessment: identity, zero trust, cloud, OT and the software you build.
Identity & access
Identity architecture and cleanup: joiner-mover-leaver, MFA coverage, privileged access, conditional access and access review, on-prem and cloud.
Learn more →Zero trust
A staged zero trust programme, not a product: identity, device health, segmentation and least privilege, sequenced so each phase delivers on its own.
Learn more →OT & ICS security
Securing the systems that move, heat and manufacture. Passive discovery, protocol-aware monitoring, safe assessment, IT/OT segmentation.
Learn more →Cloud security
Configuration and architecture review across major cloud platforms: identity, workloads, logging and remediation mapped to recognised benchmarks.
Learn more →Application security
Secure code review, dependency analysis, application and API testing, secure-by-design review, with findings delivered where your developers work.
Learn more →API security
Manual API security testing against the OWASP API Top 10: authentication, object-level authorization, schema review and business-logic abuse.
Learn more →DevSecOps
Security built into your CI/CD pipeline: SAST, DAST and SCA in CI, secrets management, infrastructure-as-code review and pipeline hardening.
Learn more →Network segmentation
Segmentation and micro-segmentation design with east-west visibility: map dependencies first, enforce in phases, contain lateral movement.
Learn more →Email security
Email authentication with SPF, DKIM and DMARC, business email compromise defence, secure email gateway tuning and user reporting that works.
Learn more →Insider threat
Insider threat programme design aligned to data protection and employment law: governance, proportionate detection and investigation hand-off.
Learn more →Data loss prevention
A DLP programme that protects sensitive data without choking productivity: discovery, classification, endpoint, email and cloud policy, tuning.
Learn more →AI & Data Security
Use AI without losing control of your data.
AI & data security overview
Learn more →SÝN ADR, AI agent monitoring
SÝN ADR records every instruction and tool call your AI agents make, and holds the session when one touches a decoy. Starts with a 2-week assessment.
Learn more →HLÍN, DLP for generative AI
HLÍN catches personal, financial and health data and secrets as staff type them into AI tools, and redacts them first. EN/FR, Chrome and Edge, via Intune.
Learn more →HILDR, sensitive-data tracking
HILDR embeds tracking markers in sensitive documents and reports where, when and on what they are opened, copied or moved outside your network.
Learn more →AI security assessment
Control the AI your staff already use and secure the AI you build: shadow-AI discovery, data-flow mapping, prompt-injection testing and governance.
Learn more →Milind AI
Milind AI is a small language model trained on real DFIR, SOC, vulnerability assessment and penetration testing work. It is the engine that powers MSOC.
Learn more →Training
Government agencies train with us. Courses and exercises for responders, staff and executives.
Law enforcement training
Government agencies train with us. Digital forensics, evidence handling and cybercrime investigation, taught by practitioners from 600+ engagements.
Learn more →SKULD security awareness
SKULD security awareness for your staff: role-based training aligned to regional regulation, paired with phishing simulation so you can see it working.
Learn more →Not sure which you need?
Describe the problem and we will point you at the right service, or the right first step. No charge.