The research behind every detection rule we write
Original threat research, detection engineering, and TTP tracking — published as security advisories and monthly briefings for the region.
Detection logic that never gets updated goes stale fast
Attacker behaviour changes constantly. Detection rules written once and left alone miss new techniques within months — sometimes weeks.
Static detection logic
Rules that never evolve stop catching anything but the obvious.
No regional context
Generic threat feeds miss the patterns specific to this region.
Research that feeds directly into detection
Original threat research
Investigation into activity we see directly, not just syndicated feeds.
Detection engineering
Research translated directly into rules the SOC uses that same week.
TTP tracking
Attacker tactics, techniques and procedures mapped and monitored over time.
Advisory publication
Findings published as public advisories when relevant to the wider region.
Monthly briefing cadence
A working session distilling the month's most relevant trends.
Regional focus
Patterns specific to banking, telecom, and donor-funded organisations here.
From research to running detection
Track
We track emerging TTPs across campaigns relevant to our client base and the wider region.
Engineer
Findings are translated into detection logic the SOC can act on immediately.
Publish
Relevant findings are published as advisories and folded into the monthly briefing.
How we think about detection coverage
Illustrative — not a real-time export of coverage for a specific environment.
What this team produces
Monthly
CTI briefing cadence
Continuous
Detection logic updates
Public
Advisory publication
Regional
Threat pattern focus
What you see from this team
Public security advisories
Published as new issues emerge, severity-ranked and dated.
Monthly CTI briefing
A working session distilling regional trends into practical guidance.
Updated detection logic
Rolled into your MDR coverage automatically, no action needed.
Ad hoc research on request
Bespoke investigation, scoped alongside your existing engagement.
Common questions
Get the next briefing before your competitors do
Book a demo to get invited to our next monthly threat intelligence briefing.