Defensive cybersecurity.
SOC alert triage and incident response
We qualify the alerts raised by the SOC and the security consoles, return a sourced verdict, then support the incident response.
EDR/XDR · network detection · Microsoft 365 / Purview DLP
Security audits
A review of your security configuration and posture. Each finding is sourced, prioritised and comes with a recommendation you can apply as written.
Microsoft 365 / Entra ID · identities · data exfiltration · application security (OWASP) · supply chain
Detection engineering and remediation
Writing and tuning detection rules, then supporting the teams until the fix is actually in place.
Detection rules · remediation support
We work only on our clients' own systems, within the scope of a signed contract and in compliance with the GDPR.
Research notes.
The password is in the transcript: where secrets handed to a security agent end up
· A test credential passed to an LLM agent is copied into the session transcript and into every delegation. The path we observed during a penetration test, the cleanup that checked the wrong place, and the controls that hold up.
Who owns the address? Attributing an IP before reading its location in SOC triage
· The location of an IP in a sign-in log often describes infrastructure, not a user. The triage rule we apply: decide who operates the address before reading its geography.
Data, not orders: prompt injection through tool content in security and coding agents
· An LLM agent that reads files, web pages, tickets or alerts also reads whatever an attacker put in them. Where untrusted text gets in, what the attacker is after, and which controls hold up.
The security review that never ran: verifying agent claims in an AI delivery pipeline
· A review agent can report PASS without opening the diff, and the audit trail says a control operated. The two forms we observed and the check that compares the claim with the runtime and the repository.