The necessary ones make the site work. The others measure which pages help and which ads bring the people who need DM11. Your choice, and you can revisit it from the footer.
Proposal
We run real attack techniques in your environment, controlled and agreed in advance, and record what your detection saw, what it merely logged and what it missed entirely. The result is a map technique by technique, and only what was actually executed goes into it: coverage claimed in a vendor datasheet stays out.
No price appears on this page. Scope does: what we do, how we run it, who runs it and what is not included. The people who read your request are the ones who will look after you, and they come back with the proposal and with time to talk it through.
The detection has been bought. What is missing is knowing what it covers.
We run real attack techniques in your environment, controlled and agreed in advance, and record what your detection saw, what it merely logged and what it missed entirely. The result is a map technique by technique, and only what was actually executed goes into it: coverage claimed in a vendor datasheet stays out.
Telemetry survey
Before talking about rules, we survey what records exist, where they come from and how long they are kept. A technique with no data source cannot be detected by any tool.
Controlled execution
We execute the techniques in your environment, in an agreed window, and record step by step what the detection saw, what it merely logged and what it missed.
Coverage analysis
We compare expected detection with observed detection and order the gaps by risk, with the rules proposed to close each one.
Presentation
A meeting with the board, translating the technical finding into business risk and an investment decision.
Usually comes together with
Not a bundle, and it changes nothing you have already chosen. It is what tends to come up next, in the experience of companies that have been through this.