Threat hunting & compromise assessment
Your tools didn't raise an alert. That doesn't mean nobody is inside. I go looking for the attacker your detection missed, and turn every finding into a detection for next time.
When it makes sense
- After an incident, to make sure the attacker is really gone
- Before or after acquiring a company and connecting its network
- When a threat targeting your sector is in the news
- A doubt you can't confirm: a strange alert, unusual traffic, a tip-off
- To get a baseline of your environment's real security
How I work
- 01
Scoping and hypotheses
We define the scope and the hypotheses to test, based on your environment and current threats.
- 02
Data collection
From your SIEM and EDR, or with Velociraptor if you have no EDR: a lightweight, read-only collection.
- 03
Hunting
Searching for traces of attacker techniques: persistence, lateral movement, credential theft, command and control.
- 04
Escalation if needed
If an active attacker is found, we switch to incident response right away.
- 05
Report and detections
A report of what was checked and found, and new detection rules for your SIEM or EDR.
What you get
- A clear answer: what was checked, what was found, and with what confidence
- Immediate escalation if an attack is in progress
- New detection rules for your tools
- Visibility gaps to close
Why Cyber Horizon
- Hands-on threat hunting experience in enterprise environments
- New detection use cases built from every hunt
- GIAC Certified Detection Analyst (GCDA) and Intrusion Analyst (GCIA)
- Incident response skills on hand if the hunt finds something
Frequently asked questions
Do we need an EDR or a SIEM?
It helps, but it's not required. Without them, I deploy Velociraptor temporarily to collect what's needed.
Will it slow down our systems?
No. The collection is lightweight and read-only, and planned with your IT team.
How long does it take?
A compromise assessment usually takes from one to a few weeks, depending on the number of systems. After the scoping call, you receive a proposal.
What if you find an attacker?
We switch to incident response immediately: containment first, then the full investigation.