Threat Hunting & Incident Investigation

Your network
is being
explored.

The average attacker spends 197 days inside a network before anyone notices. In that time, they map your systems, harvest your credentials, and exfiltrate your data — silently, methodically, and without triggering a single alert.

Get an Instant Quote
197 avg. days of undetected dwell time
68% of breaches involve data exfiltration
197 days average dwell time 68% of breaches involve exfiltration Your last audit was a snapshot. Ours is a hunt. Cloud threat hunt from £25 per user Results delivered in 5 business days Trust Centre ready report included 197 days average dwell time 68% of breaches involve exfiltration Your last audit was a snapshot. Ours is a hunt. Cloud threat hunt from £25 per user Results delivered in 5 business days Trust Centre ready report included

The breach already happened.
You're just the last to know.

Your firewall is on. Your antivirus is running. Your compliance box is ticked.

And somewhere inside your network, an attacker is quietly doing their job.

Modern threat actors don't smash and grab. They move slowly, carefully, and deliberately. They harvest credentials over weeks. They identify your most sensitive data stores. They establish persistence so that even if you find them once, they come back.

By the time your alerts fire, the damage is done. Intellectual property stolen. Customer data sold. Ransomware pre-positioned and ready to detonate.

Your existing tools detect known threats. We hunt unknown ones.

197
Average days an attacker dwells inside a network before detection
68%
Of breaches involve the exfiltration of sensitive data
£3.7M
Average cost of a data breach to a UK organisation in 2024
74%
Of breaches involved the human element — stolen credentials, phishing, or abuse

Turn your threat hunt into
compliance evidence.

Cyber insurers, enterprise procurement teams, and regulatory auditors are no longer satisfied with "we have antivirus and a firewall."

They want to see documented, proactive security activity. They want evidence that someone is actively looking for threats inside your environment — not just waiting for an alert.

Every Proactive Security Investigations engagement delivers a structured findings report you can place directly into your Trust Centre. Clear. Dated. Evidenced. Signed off by a qualified investigator.

Lower your insurance premiums Show your cyber insurer documented proactive hunting activity. Reduce your risk profile.
Satisfy procurement security reviews Enterprise customers require evidence of active security programmes. We provide it.
Demonstrate regulatory compliance Dated, signed investigation reports that satisfy auditors and regulators across sectors.
Build customer trust Show your customers you take security seriously — with evidence, not just a checkbox.

Three engagements.
One purpose. Find what's hiding.

Cloud

Cloud
Threat Hunt

£25 per user

Your cloud environment is your biggest attack surface and your least visible one. Misconfigured permissions. Dormant compromised accounts. Data quietly leaving via approved channels.

  • M365 and Azure tenant investigation
  • Credential compromise detection
  • Privilege escalation hunting
  • Data exfiltration indicators
  • Full findings report
  • Trust Centre ready documentation
Minimum: 25 users / £625
Get a Quote
Endpoint

Endpoint
Threat Hunt

£20 per endpoint

Your endpoints are where attackers live. Long after initial access, they persist in startup jobs, scheduled tasks, and memory — invisible to standard AV, waiting. We deploy a lightweight agent to your Windows environment to hunt them down.

  • Malware persistence hunting
  • Credential harvesting tool detection
  • Lateral movement artefact analysis
  • Living-off-the-land technique detection
  • Full findings report
  • Trust Centre ready documentation
Minimum: 25 endpoints / £500
Get a Quote

Get an instant quote.

Enter your user and endpoint counts below. Pricing is transparent and fixed — no hidden fees, no sales call required.

Fast, clean,
no disruption.

01

Get a Quote

Enter your user and endpoint count. Pricing is instant and transparent — no sales process required.

02

Onboard in Hours

We deploy a lightweight agent to your Windows endpoints. Onboarding is fast and low-friction — typically complete in under 4 hours.

03

The Hunt Begins

Our investigators get to work. Most engagements complete within 5 business days.

04

Receive Your Report

A clear, structured findings document. Prioritised risks. Evidenced findings. Trust Centre ready.

Built by investigators.
Not just analysts.

Our team brings together backgrounds that most security firms simply cannot offer. Regulatory investigation experience from the ICO, over a decade of digital forensics and incident response, and deep operational knowledge of how real attackers move through real environments.

We have worked on investigations spanning data breaches affecting millions of records, insider threat cases, and nation-state attributed incidents. When we hunt, we know exactly what we are looking for — because we have seen it before.

ICO Investigation Experience

Regulatory Background

Direct experience working within the Information Commissioner's Office, conducting investigations into data breaches, GDPR enforcement, and organisational security failures. We know what regulators look for — and how to find it before they do.

ICO GDPR Regulatory Enforcement Data Breach Investigation

10+ Years DFIR

Digital Forensics and Incident Response

Over a decade of hands-on digital forensics and incident response across private sector, public sector, and law enforcement-adjacent engagements. We have responded to ransomware, data exfiltration, insider threats, and advanced persistent threat activity at scale.

DFIR Ransomware Response Threat Intelligence Forensic Analysis

Enterprise-Grade Tooling

Powered by Leading Technology

Our investigators are backed by enterprise threat hunting and detection technology, enabling us to deliver findings in days rather than weeks. The kind of visibility that was previously available only to organisations with mature, fully-staffed security operations centres.

EDR Analysis Cloud Telemetry Threat Hunting Platforms IOC Analysis

What our clients found.

We had no reason to believe anything was wrong. Our AV was clean, no alerts, nothing unusual. Within three days of the cloud hunt, the team had identified a compromised service account that had been active for over four months. The findings report went straight into our Trust Centre and satisfied our cyber insurance renewal with no issues.

Head of IT UK Professional Services Firm, 180 employees

We commissioned the Full Spectrum Hunt ahead of a significant enterprise contract that required us to demonstrate proactive security controls. The report gave us exactly what we needed — a credible, evidenced document that showed genuine investigative work had been done, not just a checkbox exercise. The contract was signed.

Chief Operating Officer SaaS Technology Company, 60 employees

After a competitor in our sector suffered a major breach, our board wanted assurance that we were not exposed. The endpoint hunt was completed inside a week. Two findings came back — one critical, one medium. Both were remediated before any damage could occur. The speed and clarity of the report made a difficult board conversation significantly easier.

IT Director Financial Services Business, 320 employees

Real hunts.
Real findings.

Cloud Threat Hunt

Compromised Identity Undetected for 5 Months

A 140-user professional services firm commissioned a cloud threat hunt ahead of a client security audit. No prior indicators of compromise had been flagged by their existing tooling.

  • A dormant admin account had been accessed repeatedly from an unusual geographic location over 22 weeks
  • The account had been used to enumerate SharePoint document libraries containing client contracts and financial data
  • Conditional access policies had a misconfiguration that allowed legacy authentication bypass, enabling the initial access
  • Over 3,400 files had been accessed across the dwell period
Outcome Immediate account isolation, legacy auth disabled, and ICO notification submitted within the 72-hour window. Full findings report used to demonstrate containment to affected clients.
Full Spectrum Hunt

Pre-Ransomware Staging Discovered Before Detonation

A 250-endpoint manufacturing business engaged us following an industry peer suffering a significant ransomware incident. They had no symptoms but wanted assurance before their annual cyber insurance renewal.

  • A remote monitoring tool had been installed on 14 endpoints, consistent with known ransomware affiliate tooling
  • Lateral movement had occurred from an initial phishing compromise three weeks prior
  • Credentials for a domain admin account had been harvested and were being staged
  • A scheduled task was present that matched known pre-ransomware persistence patterns
Outcome Ransomware deployment was pre-empted by 11 days based on staging indicators. Estimated business impact avoided: upwards of £800,000 in downtime, recovery, and regulatory exposure.
Endpoint Threat Hunt

Insider Data Exfiltration Across 8 Weeks

A 90-person recruitment business noticed an unusual pattern in file access logs but lacked the tooling to investigate. An endpoint hunt was commissioned across their 90 devices.

  • A departing employee had been systematically copying candidate and client databases to an external cloud storage account
  • The exfiltration had begun 8 weeks before their resignation date
  • Over 14,000 candidate records and 600 client contacts had been exfiltrated
  • The method used was designed to avoid triggering DLP rules by operating below threshold volumes
Outcome Forensic findings provided to solicitors. ICO notified. Legal proceedings initiated. Report used as primary evidence in employment tribunal proceedings.
Cloud Threat Hunt

Supply Chain Credential Abuse via Third-Party Breach

A 200-user logistics company was unaware that a software supplier they used had suffered a breach six months prior. Staff credentials from that supplier had been circulating on dark web forums.

  • Four employee accounts had been accessed using credentials obtained from the third-party breach
  • Email forwarding rules had been quietly configured on two accounts to an external address
  • Sensitive commercial tender documents had been forwarded over a 10-week period
  • The accounts showed no failed login attempts — access was clean and deliberate
Outcome Forwarding rules removed, accounts secured, and affected tenders reviewed. Findings informed a broader supplier security review and contributed to the company's ISO 27001 certification evidence pack.

The question isn't whether someone is in your network.
It's whether you'd know.

Most organisations find out about a breach from a third party — a bank, a customer, law enforcement, or a ransomware note. Don't be most organisations.