Engagements / Defensive security
Three deliverable-driven cyber defense engagements.
Start with a bounded engineering task and agreed evidence criteria. These packages are scope templates—not fixed-price offers, available staffing promises or existing defense contracts.
Package 01
Malware Triage & Technical Analysis
Security operations, incident-response and supplier assurance teams
Typical work
- Inventory and verify authorized sample provenance, classification and collection scope.
- Static and, when safely supported, isolated dynamic behavior analysis.
- Map suspected persistence, network behavior and impacted execution paths.
Deliverables
- Evidence inventory with hashes and confidence labels.
- Technical behavior report, indicators and containment recommendations.
- Questions that cannot be resolved from the available evidence.
Acceptance & exclusions
Report maps every material claim to a sample, observable artifact or explicit analyst hypothesis.
Not included by default: No guarantee of malware identification, decryption, live incident command or unlimited sample processing.
Review detailed service scopeNo unsolicited live malware, source code, customer evidence, credentials, CUI or export-controlled data should be emailed or uploaded to the public site. Safe transfer is arranged after written authorization, classification and retention planning.
Package 02
Mobile & Embedded Threat Assessment
Enterprise mobility, product security and authorized device programs
Typical work
- Review Android/iOS app artifacts, permissions, signing and runtime behavior where feasible.
- Assess suspicious SDK, transport, firmware/interface or backend trust assumptions.
- Validate scoped negative paths with approved test devices and authorization.
Deliverables
- Observed attack surface and trust-boundary map.
- Prioritized findings with implementation-ready remediation guidance.
- A test matrix and retest criteria against each confirmed issue.
Acceptance & exclusions
Each reported finding includes scope, technical evidence, severity rationale and a reproducible validation step.
Not included by default: No device unlocking, protected-data access, unauthorized malware execution or specialized hardware lab is presumed.
Review detailed service scopePackage 03
Threat Detection Engineering Sprint
SOC engineering, cyber defense and platform security teams
Typical work
- Agree hypothesis, telemetry coverage, rule target and safe test environment.
- Write or refine scoped detections and positive/negative test fixtures.
- Review alert noise, blind spots, deployment constraints and owner handoff.
Deliverables
- Rule pack or SIEM/EDR implementation specification.
- Synthetic or approved detection test results and false-positive analysis.
- Operator runbook, versioned handoff and tuning recommendations.
Acceptance & exclusions
Rule behavior is tested against agreed fixtures with measurable true/false alerts and documented known gaps.
Not included by default: No managed 24/7 SOC, threat-feed subscription or guaranteed detection of all attack techniques.
Review detailed service scopeBefore a scope becomes an agreement
Confirm the contracting entity, buyer requirements, authorized targets, personnel capacity, export controls, confidentiality, approved data environment, deliverable acceptance, schedule, fees, incident response responsibilities and any subcontract security flow-downs. Pricing and timing are quoted after discovery and a signed SOW.
Request a tailored engagement proposal