Solutions
Four services.
One operation.
You can buy one of these, or all of them. What changes when they run together is that a detection in the control room becomes an action by the response team immediately, and the investigation comes back as a change to the controls — with nobody coordinating between vendors.
- 01 · SIEM / SOC
24/7 cyber defence centre
A control room that alerts in real time on security events in critical systems, and responds in full when an attack lands.
- Tier 1–2 continuous monitoring
- Tier 3 forensics
- A monthly review for management
- 02 · IR / IRT
Incident response
A team that steps into a live incident: containment, forensics, recovery and lessons learned. On retainer or in an emergency — customer or not.
- First call within 15 minutes
- A report for regulator and insurer
- Negotiation events
- 03 · SMB
Managed multi-layered protection
The business’s outsourced security unit: email, endpoints and mobile — one provider, one invoice.
- The same SOC, even at 30 staff
- MFA enforcement
- A document you can show an insurer
- 04 · GRC
Consulting and implementation
We start with the picture, not the technology: risk assessment, regulation, penetration testing, CISO as a service and training.
- ISO 27001 · privacy
- Penetration testing
- CISO as a service
The group’s technology
What runs underneath the SOC.
MITRE ATT&CK
What we actually detect.
Our detection coverage, mapped to tactics and techniques. What is still on the roadmap is marked as such — which is exactly what makes the rest worth believing.
- Full coverage
- Partial coverage
- On the roadmap
Initial Access
PhishingValid AccountsExternal Remote ServicesSupply ChainExecution
PowerShellWMIScheduled TaskContainer AdminPersistence
Registry Run KeysCreate AccountBoot AutostartBITS JobsPrivilege Escalation
Token ManipulationBypass UACExploit for PEDefense Evasion
Clear Event LogsImpair DefensesObfuscationRootkitCredential Access
LSASS MemoryBrute ForceKeyloggingKerberoastingLateral Movement
RDPSMB SharesSSHPass-the-HashExfiltration
Exfil over C2Cloud StoragePhysical MediaImpact
Data EncryptedInhibit RecoveryService StopDefacementCoverage is reviewed and updated quarterly, and reported to the customer as part of the monthly review.
The decision
Three ways to defend an organisation.
Written from the point of view of somebody who has to decide, not of a vendor who has to sell.
| TripleCyber | In-house team | General IT provider | |
|---|---|---|---|
| Monitoring at night and at weekends | ✓ | On-call dependent | — |
| A response team that turns up | ✓ | Usually not | — |
| Forensics and root-cause analysis | ✓ | Rare | — |
| Mapping to MITRE ATT&CK | ✓ | Tooling dependent | — |
| Reporting for a regulator or insurer | ✓ | Depends | — |
| Time to stand up | Weeks | Months to a year | Days |
| Cost to start | A monthly package | 3–6 salaries | Low |
"General IT provider" is not a criticism — they were simply not built for this, exactly as we were not built to fix a printer.
Where we already work
- Critical infrastructure
- Local authorities
- Finance and insurance
- Law and accounting firms
- Supply chain
- Hazardous materials
- Telecom providers
- Small and mid-sized business
Emergency line · 24/7/365
Under attack?
Do not shut anything down. Call.
Shutting a machine down wipes volatile memory — and part of the evidence with it. Disconnect from the network if you can, delete nothing, and call. A senior analyst is on the line within 15 minutes, customer or not.
08-691-4954