- CRITCredential dumping via LSASS accessFIN-SRV-04T1003.001
- CRITMass file encryption on network shareFILES01T1486
- HIGHImpossible travel — TLV then Lagos, 9 minM365T1078.004
- HIGHSuspicious inbox forwarding rule createdM365T1114.003
- MEDPowerShell encoded commandWKS-1182T1059.001
- MEDNew service installed on domain controllerDC-02T1543.003
- MEDOutbound beacon to newly registered domainWKS-0934T1071.001
- MEDKerberoasting — 14 service tickets requestedDC-01T1558.003
- LOWLegacy TLS 1.0 handshake acceptedVPN-GWT1040
- LOWPassword spray against OWA, 41 accountsM365T1110.003
SOC · SIEM · IR — staffed now · --:--:-- IL
When someone tries to stop you — we are already inside.
A control room staffed around the clock, an immediate response team and managed multi-layered protection. We see the attack while it is happening, and stop it before it becomes a business incident.
- 24/7/365 Continuous monitoring
- Tier 1–3 Monitoring, investigation, forensics
- IRT Immediate response team
- 2016 Operating since
TIER 1 · ANALYST ON SHIFT
Behind every alert
there is a person.
An algorithm detects. An analyst understands. Our analysts work from a broad, current intelligence picture — and what is caught at one customer protects all the others.
IR-2026-0412 · ransomware
Three minutes.
From detection to containment.
- 00:41From anomalous LSASS access to alert
- 02:58To server isolation from the console
- 147Files restored from backup
- 0Resident services lost
24/7/365
He is awake right now.
At --:-- Israel time.
The control room is staffed around the clock — at two in the morning, at the weekend, on holidays. If you are in an incident right now, he is the one who answers.
INCIDENT REPLAY · IR-2026-0412
One night in the control room.
Scroll — and watch it happen.
02:40:00 CONTAINED
- DETECT EDR: anomalous LSASS memory access by svc_backup on FIN-SRV-04
- ALERT SIEM: three failed logons then one success from 10.4.19.77 — out of pattern
- ACTION Tier 1 escalates to Tier 3. Incident IR-2026-0412 opened.
- CRITICAL File-encryption behaviour on FILES01\finance — 147 files touched
- ACTION Network isolation applied to FIN-SRV-04 and FILES01 from the console
- ACTION Three accounts force-reset; every session revoked
- ACTION C2 domain cdn-update-check[.]net blocked at the perimeter
- CONTAINED Encryption stopped. All 147 files restored from the 23:00 snapshot.
- CONTAINED Root cause: a VPN account with no MFA. Report delivered to the customer.
A real incident at one of our customers, published with their consent. Identifying details were changed; the timings were not.
One minute in the SOC
What you see from here.
A look at what crosses the screens — from telemetry to containment.
The SOC is staffed now. And in eight hours, and at the weekend, and on holidays.
68%
- 23 full
- 6 partial
- 5 roadmap
Out of 34 techniques in the matrix below. What is not covered says so.
- TelemetryEndpoint · cloud · email · identity
- SIEMRules mapped to ATT&CK
- Tier 1–2Monitoring and alerting
- Tier 3Investigation and forensics
- IRTContainment and recovery
- Windows
- macOS
- Linux
- iOS
- Android
Endpoints, servers, cloud, email and identities — one console.
Inbound · simulation
From everywhere.
To one point.
Attacks on Israeli organisations do not respect borders or business hours. This is what the inbound picture looks like when it meets a control room that never sleeps.
0 blocked in this simulation
since you opened the page
since you opened the page
Blocked · live
Simulation. Sources and volumes are illustrative, not live data.
IL · 32.08°N 34.78°E
Four services · one operation
Detection that turns into action.
You can buy one of these, or all of them. When they run together, a detection in the control room becomes an action by the response team immediately, and the investigation comes back as a change to the controls — with nobody coordinating between vendors.
All solutions- 01 SIEM / SOC
24/7 cyber defence centre
A control room that alerts in real time on security events in critical systems, and responds in full when an attack lands.
- Tier 1–2 continuous monitoring
- Tier 3 forensics
- A monthly review for management
- 02 IR / IRT
Incident response
A team that steps into a live incident: containment, forensics, recovery and lessons learned. On retainer or in an emergency — customer or not.
- First call within 15 minutes
- A report for regulator and insurer
- Negotiation events
- 03 SMB
Managed multi-layered protection
The business’s outsourced security unit: email, endpoints and mobile — one provider, one invoice.
- The same SOC, even at 30 staff
- MFA enforcement
- A document you can show an insurer
- 04 GRC
Consulting and implementation
We start with the picture, not the technology: risk assessment, regulation, penetration testing, CISO as a service and training.
- ISO 27001 · privacy
- Penetration testing
- CISO as a service
Case files
What happened to our customers — and what did not.
Local authority
Ransomware stopped before it spread
- Situation
- A VPN logon from a service account with no MFA, at 02:40. The authority runs resident services that cannot go down.
- Action
- Two servers isolated in under three minutes, credentials reset, the command channel blocked.
- Outcome
- Not one resident service was interrupted, and no ransom was paid.
- 41Seconds to detect
- 2:58Minutes to contain
- 0Services lost
“They called us at two in the morning, before we knew there was an incident at all. By morning every resident service was running normally.”Head of IT, local authority
Law firm
An email leak stopped the same day
- Situation
- A forwarding rule was created and hidden inside a senior partner’s mailbox. Every incoming message was copied to an external address.
- Action
- The rule was found and removed, MFA enforced across every mailbox, and 88 further mailboxes swept.
- Outcome
- Not one client document left the firm. The disclosure duty was assessed and did not trigger.
- 88Mailboxes swept
- 0Days to discovery
- 0Documents leaked
“What impressed us was not the technology, it was the report. For the first time we understood exactly what had happened and what to change.”Managing partner, law firm
Industrial manufacturer
The supplier was breached; the customer was not
- Situation
- A subcontractor’s remote access was used to try to reach the operational (OT) network.
- Action
- Supplier access cut, the OT network segmented, and a supply-chain review run across all 34 suppliers.
- Outcome
- The production lines kept running throughout.
- 34Suppliers reviewed
- 7Minutes to block
- 0Hours of lost production
“Our supplier was breached. We were not. That is the whole story.”Operations manager, industrial manufacturer
MITRE ATT&CK
What we actually detect.
Our detection coverage, mapped to tactics and techniques. What is still on the roadmap is marked as such — which is exactly what makes the rest worth believing.
- Full coverage
- Partial coverage
- On the roadmap
Initial Access
PhishingValid AccountsExternal Remote ServicesSupply ChainExecution
PowerShellWMIScheduled TaskContainer AdminPersistence
Registry Run KeysCreate AccountBoot AutostartBITS JobsPrivilege Escalation
Token ManipulationBypass UACExploit for PEDefense Evasion
Clear Event LogsImpair DefensesObfuscationRootkitCredential Access
LSASS MemoryBrute ForceKeyloggingKerberoastingLateral Movement
RDPSMB SharesSSHPass-the-HashExfiltration
Exfil over C2Cloud StoragePhysical MediaImpact
Data EncryptedInhibit RecoveryService StopDefacementCoverage is reviewed and updated quarterly, and reported to the customer as part of the monthly review.
The decision
Three ways to defend an organisation.
Written from the point of view of somebody who has to decide, not of a vendor who has to sell.
| TripleCyber | In-house team | General IT provider | |
|---|---|---|---|
| Monitoring at night and at weekends | ✓ | On-call dependent | — |
| A response team that turns up | ✓ | Usually not | — |
| Forensics and root-cause analysis | ✓ | Rare | — |
| Mapping to MITRE ATT&CK | ✓ | Tooling dependent | — |
| Reporting for a regulator or insurer | ✓ | Depends | — |
| Time to stand up | Weeks | Months to a year | Days |
| Cost to start | A monthly package | 3–6 salaries | Low |
"General IT provider" is not a criticism — they were simply not built for this, exactly as we were not built to fix a printer.
Where we already work
- Critical infrastructure
- Local authorities
- Finance and insurance
- Law and accounting firms
- Supply chain
- Hazardous materials
- Telecom providers
- Small and mid-sized business
Frequently asked
What do we do the moment we spot a cyber attack?
Call the line on 08-691-4954. It is staffed 24/7, and the immediate response team moves in to stop the attack. Important: do not shut machines down and do not delete files — that destroys the evidence the investigation needs.
We are not your customer. Will you help in a live incident?
Yes. The line takes emergency calls from organisations that are not customers. We start with a short call to assess the situation, and step in from there.
What is the difference between a SOC and a SIEM?
A SIEM is the system that collects and analyses security events from across the organisation. A SOC is the human control room that watches those events 24/7, investigates and responds. We provide both as one managed service.
Is this suitable for a small business?
Yes. The small and mid-sized business unit is built for exactly that, for organisations of up to about 100 people, with managed packages that need no in-house security department.
Do you help meet insurer requirements?
Yes. Much of our work is standards and regulatory alignment: risk assessment, a work plan and the controls needed to reach the standard insurers demand.
What does the risk assessment include?
A comprehensive evaluation of the organisation’s security risk, a whole-estate defence plan and a detailed recommendations document — with a work plan built on it.
Emergency line · 24/7/365
Under attack?
Do not shut anything down. Call.
Shutting a machine down wipes volatile memory — and part of the evidence with it. Disconnect from the network if you can, delete nothing, and call. A senior analyst is on the line within 15 minutes, customer or not.
08-691-4954