Capabilities

What we do, and how it gets scoped.

Each line below carries the work performed, typical deliverables, and the framework codes a PWS or SOW can reference directly.

Service line 01

Digital Forensics & Incident Response

Memory, disk, and network forensics on compromised hosts and enclaves — from first triage through the reportable timeline of what the adversary touched.

Work performed
  • Volatile memory acquisition and analysis (Volatility, custom plugins)
  • Disk and filesystem forensics, deleted and slack-space recovery
  • Hibernation, paged-memory, and key material recovery
  • Network capture reconstruction of exfiltrated data
  • Incident timelines and indicator sets for detection engineering
NICE work roles
IN-FOR-002 PR-CIR-001 IN-INV-001
CSF 2.0 / 800-53
RS.AN RS.MI IR-4 IR-6 AU-6
Deliverables

Forensic report, artifact inventory, timeline, IOC package, testimony-ready documentation.

Service line 02

Malware Analysis & Threat Intelligence

Reverse engineering of obfuscated and protected malware, including APT tooling, rootkits, and custom C2 protocols — turned into detections you can deploy.

Work performed
  • Static and dynamic analysis of packed, obfuscated, and protected binaries
  • Defeat of commercial protectors and anti-analysis layers
  • C2 protocol reversing, decoder recovery, and traffic decryption
  • Signature and rule authoring at scale for network and host platforms
  • Adversary TTP documentation and campaign attribution support
NICE work roles
AN-TWA-001 PR-CDA-001 AN-ASA-001
CSF 2.0 / 800-53
DE.AE DE.CM SI-3 SI-4
Deliverables

Analysis reports, detection signatures, decoders, indicator feeds, threat briefings.

Service line 03

AI-Assisted Reverse Engineering & Tooling

Local LLMs wired into Ghidra and IDA Pro through MCP servers and custom context engineering — analyst throughput without sending binaries off premises.

Work performed
  • Air-gapped local LLM deployment for binary analysis workflows
  • MCP servers and tool surfaces for Ghidra and IDA Pro
  • Context and prompt engineering tuned to firmware and RE accuracy
  • Automated triage, function naming, and bug-candidate ranking
  • Custom Python and IDAPython harnesses around the model loop
NICE work roles
SP-DEV-001 SP-SRP-001 AN-EXP-001
CSF 2.0 / 800-53
ID.IM SA-11 SA-15
Deliverables

Deployed toolchain, MCP servers, prompt and context libraries, operator runbooks, training.

Service line 04

AI System Security & Assurance

Security testing and risk documentation for AI and agentic systems, scoped against the NIST AI RMF and the Generative AI Profile rather than a checklist.

Work performed
  • Threat modeling of model, data, pipeline, and agent tool surfaces
  • Adversarial testing: prompt injection, jailbreak, data and model extraction
  • Red teaming of agentic systems and their tool permissions
  • AI RMF GOVERN/MAP/MEASURE/MANAGE artifact development
  • Control tailoring for AI components inside an existing ATO boundary
NICE work roles
SP-RSK-002 SP-ARC-002 SP-TST-001
CSF 2.0 / 800-53
GV.RM ID.RA RA-3 CA-2 SR-11
Deliverables

AI risk profile, adversarial test report, control tailoring memo, remediation plan.

Service line 05

Red Team & Penetration Testing

Full-scope assessment of heterogeneous enterprises, embedded devices, and mobile networks — including the capability development the objective requires.

Work performed
  • Zero-knowledge and objective-based red team operations
  • Firmware, RTOS, and embedded device assessment (ARM, RISC)
  • Mobile and telecom network testing across GSM through 5G
  • Fuzzing and harness development (AFL++, Unicorn emulation)
  • Custom implant and tooling development for red team objectives
NICE work roles
PR-VAM-001 AN-EXP-001 CO-OPS-001
CSF 2.0 / 800-53
ID.RA PR.PS CA-8 RA-5 SI-2
Deliverables

Rules of engagement, attack narrative, finding set with severity, retest and mitigation guidance.

Service line 06

Training & Workforce Development

Course-grade instruction built from real casework: reverse engineering, forensics, and AI-assisted analysis taught to the teams who will run it after we leave.

Work performed
  • Curriculum development mapped to NICE work role KSAs
  • Hands-on RE, forensics, and malware analysis courses
  • AI-for-analysts tracks covering local LLM tooling and MCP
  • Lab environment build-out and range scenario authoring
  • Published technical manuals and instructor materials
NICE work roles
OV-TEA-001 OV-TEA-002 OM-ANA-001
CSF 2.0 / 800-53
PR.AT AT-2 AT-3
Deliverables

Courseware, lab images, instructor guides, assessment instruments, delivery on site or remote.