Digital Forensics & Incident Response
Memory, disk, and network forensics on compromised hosts and enclaves — from first triage through the reportable timeline of what the adversary touched.
Memory, disk, and network forensics on compromised hosts and enclaves — from first triage through the reportable timeline of what the adversary touched.
Reverse engineering of obfuscated and protected malware, including APT tooling, rootkits, and custom C2 protocols — turned into detections you can deploy.
Local LLMs wired into Ghidra and IDA Pro through MCP servers and custom context engineering — analyst throughput without sending binaries off premises.
Security testing and risk documentation for AI and agentic systems, scoped against the NIST AI RMF and the Generative AI Profile rather than a checklist.
Full-scope assessment of heterogeneous enterprises, embedded devices, and mobile networks — including the capability development the objective requires.
Course-grade instruction built from real casework: reverse engineering, forensics, and AI-assisted analysis taught to the teams who will run it after we leave.
Contracting officers evaluate against frameworks. Our capability matrix cross-walks each service line to NICE work roles for labor categories and DoD 8140 qualification, CSF 2.0 categories for outcome language, and 800-53 controls for assessment evidence.
Open the alignment matrixAN-EXP-001
Exploitation Analyst — firmware VR and exploitability assessment
IN-FOR-002
Cyber Defense Forensics Analyst — memory and disk investigation
DE.AE
Adverse Event Analysis — malware characterization into detections
CA-8
Penetration Testing — assessment evidence for the security package