Our analysts search your laptops, servers, accounts and logs for attackers your security tools didn't flag, then show you how they got in and how to keep the next one out.
If any of these sound like your week, you are in the right place. Each one is fixable.
A sluggish server, a login from a town nobody visited, a payment that went to the wrong account after a supplier "changed banks". Your antivirus shows green, but you can't shake the feeling.
The ransomware was cleaned up and systems were restored, but nobody established how the attacker got in. If that door is still open, they can walk back through it.
A supplier, parent company or IT vendor with access to your network has had an incident. You need to know whether it reached you, and you need to know soon.
You're about to connect another organisation's network to yours, along with every problem hiding inside it. Better to find them before the systems are joined.
Security tools are good at catching what they've seen before. A patient attacker using a stolen login and the same admin tools your IT team uses can look like ordinary work for weeks. The longer they stay, the more they learn: where the money moves, where the backups are kept, which accounts matter.
Threat hunting starts from the assumption that something has already slipped through. Our analysts build hypotheses from MITRE ATT&CK and current threat intelligence, then search your endpoint, identity, email and network data for evidence of those techniques. You find out if anyone is inside and how an attacker could get in, and you keep the new detection rules each hunt produces.
Clear, specific work, delivered by people who will still be around after launch.
A one-off deep check of your endpoints, accounts, mailbox rules and logs for evidence of past or ongoing intrusion, ending in a clear yes or no, with the evidence behind it.
Targeted hunts for the techniques most likely to be used against your sector, such as stolen credentials, malicious mailbox rules or misuse of remote access tools.
Current indicators of compromise and attacker behaviour relevant to your sector and the countries you operate in, including the payment fraud and email scams common across Africa, turned into searches we run in your environment.
Every hunt leaves behind detection rules in your own security tools, so the next attempt using the same technique raises an alert on its own.
A technical report for IT and a short brief for management: what we looked for, what we found, how serious it is and what to do next.
Monthly or quarterly hunts that rotate through different attacker techniques, so your coverage grows over time instead of stopping after one exercise.
Four stages, each with something you can see and sign off before we move on.
We agree which systems are in scope, then gather data from your endpoint, identity, email and network tools, adding lightweight collectors where there are gaps.
Stage 1 of 4Using MITRE ATT&CK, recent intelligence and what we learn about your business, we decide which attacker behaviours are most worth hunting for in your environment.
Stage 2 of 4Analysts search for those behaviours, rule out innocent explanations and confirm anything real. If we find an active attacker, we tell you immediately and move to response.
Stage 3 of 4You get findings, root causes and fixes, plus new detection rules installed in your tools so the same technique is caught next time.
Stage 4 of 4Tell us what's worrying you. We'll scope a compromise assessment that answers the question, and tell you exactly what we need from your team to get started.
Or call +233 24 886 9658Recognised frameworks and platforms, not home-made checklists. Ask us how each one applies to you.
Straight answers to what people ask us before they start.
Still have a question?
Call us on +233 24 886 9658 or send us a message. A real person will get back to you.
Threat hunting is a proactive search for attackers who are already inside your systems but haven't triggered an alert. Instead of waiting for tools to raise an alarm, analysts start from a hypothesis about how an attacker might operate, then search logs, devices and accounts for evidence of it. It catches the quieter intrusions that use stolen passwords and normal admin tools to blend in.
A penetration test checks whether an attacker could get in; threat hunting checks whether one already has. Penetration testers try to break in from outside using the weaknesses they find. Threat hunters look inside, at your logs and devices, for signs of past or ongoing compromise. Most organisations benefit from both at different times, and the findings of each make the other more useful.
The surest way is a compromise assessment, because many intrusions show no obvious symptoms. Warning signs to take seriously include mailbox rules forwarding mail outside the company, sign-ins at odd hours or from abroad, new admin accounts nobody created, security tools that were switched off and unusual data leaving the network. If you've seen any of these, or a partner has reported a breach, get it checked.
We need read access to the security data your systems already produce: endpoint detection logs, sign-in and audit logs from Microsoft 365, Entra ID, Okta or Google Workspace, firewall logs and server event logs. Where data is missing, we add lightweight collectors for the length of the hunt. Access is read-only, logged and removed when we finish, and we work under a signed non-disclosure agreement.
We tell you straight away, not in the final report. We agree an escalation contact before the hunt starts, and if we find an active compromise we move into incident response with you: containing affected accounts and devices, preserving evidence, removing the attacker and helping you work out what you may need to report. For clients in Ghana that could mean the Cyber Security Authority or the Data Protection Commission; elsewhere, bodies such as Nigeria's Data Protection Commission, Kenya's Data Commissioner or South Africa's Information Regulator.
Both depend mainly on how many devices and users are in scope and how much useful log data you already have. A compromise assessment of a single office is a defined project with a fixed quote; a recurring hunt programme is a monthly or quarterly fee. Organisations with good logging get answers faster, because we spend less time collecting data. We quote after a short scoping call.
Yes, because a hunt works on data, not buildings. Logs from your laptops, servers, cloud accounts and email are gathered centrally whichever country the device sits in, so one hunt can cover a head office in Accra, a branch in Lagos and staff working from home abroad. We agree an urgent contact in each time zone before we start. If a machine needs forensic work that can't be done remotely, we arrange it with you.
Most organisations start with one of these and add the rest as they grow. Here is where this service fits.
