Solutions
Cybersecurity and intelligence.
Intelligence services are research and analysis of material an organisation is entitled to provide. Cybersecurity covers defence of systems in operation, authorised testing, digital forensics and incident response.
Intelligence services
Research and analysis.
The work uses the disciplines listed below. Each record keeps the source, the date, and the conclusion together.
OSINT
Open source
Analysis of published and other publicly available material. The source, the date, and the confidence stay with the conclusion.
HUMINT
Human
Analysis of interviews and debriefs already on the record: who spoke, when, how reliable the account is, and what it supports.
SIGINT
Signals
Analysis of communications and electronic-signal reporting already held: emitter or protocol, time, and the conclusion drawn from it.
GEOINT
Geospatial
Imagery and geospatial analysis. The coordinate, the sensor, the acquisition time, and the observation stay in one record.
MASINT
Measurement
Measurement and signature intelligence: radar, seismic, acoustic, and related sensors, with the unit, the method, and the uncertainty kept in the file.
TECHINT
Technical
Technical intelligence on equipment: identification, condition, modifications, and comparison with earlier sightings.
CYBINT
Cyber intelligence
Cyber intelligence on infrastructure, accounts, malware, and timelines already observed. A link is written only where the evidence supports it.
FININT
Financial
Financial intelligence: payments, counterparties, amounts, and time, set out so a funding or laundering question can be followed.
RUMINT
Rumor
Unverified reporting, marked as unverified, with who passed it, when, and what would confirm or discard it.
SOCMINT
Social media
Analysis of public social-media material: the post, the account, the time, and why it was relevant.
Cybersecurity
Defence, testing, forensics and response.
Defensive work applies to systems already in operation, including log collection the client authorises for its own environment. Testing is reported against the techniques that were exercised. MITRE ATT&CK is a knowledge base for adversary behaviour, not a certification and not the whole of a test method. Digital forensics and incident response are separate: one examines preserved material, the other contains and recovers.
Defense
Defence
Monitoring and controls for systems already in operation.
- Security operations: monitoring, alert triage, escalation, and a written record of each action.
- SIEM: log collection, correlation, use cases, and retention for the environment in scope.
- EDR and XDR: endpoint and cross-domain detection, tuned to the systems in scope rather than left on a vendor default.
- Patch management: inventory, severity, test, deployment, and the exceptions that are written down.
- Training for the people who operate the systems, and awareness for the wider organisation.
Offensive
Offensive security
Authorized testing of the systems in scope, reported against the techniques that were exercised.
- External, internal and application testing, and a configuration review when the scope includes it. Application testing follows a written method. Where the practice matches, that method uses the OWASP Web Security Testing Guide.
- Findings that describe adversary behaviour are mapped to MITRE ATT&CK, which is a knowledge base, not a certificate. The cyber kill chain is used only when the order of steps matters to the finding.
- The report states the method, what was attempted, what succeeded, the evidence, the condition the systems were left in, and the remediation the evidence supports.
- The scope names the systems, the window, and the contact if a test has to stop.
Forensics
Digital forensics
Preservation and examination of digital material, written so another examiner can follow the steps. A hash records integrity of a copy. It does not, by itself, prove the full history of a file.
- Identification of the hosts, accounts, and logs that bear on the question.
- Preservation and acquisition, with hashes, tool versions, and the clock offset kept with the evidence.
- Examination against the case: what ran, what changed, which account, and when.
- A report a second examiner can follow without reconstructing the work from memory.
Response
Incident response
From a reliable indication of intrusion through containment and recovery.
- Detection and analysis: what is established, what is still open, and how far the activity reaches.
- Containment, eradication, and recovery. Each decision is recorded with the time and the person who made it.
- Activity that matches a known technique is mapped to MITRE ATT&CK, so the gap in detection is visible.
- A written review after recovery: what the environment showed, and what has to change in the controls.
Delivery
A service under a scope, or a product under contract.
Services
A written scope
The scope names the question or the systems, the people who may see the material, and the result to be delivered.
Products
Research in Riyadh
InvestiGATE Pro and Synapse are developed for use in Saudi Arabia. They can be discussed from the Products page. A contract names a product only when the engagement includes it.