Threat Hunting Service
Most breaches go undetected for over 200 days. Automated tools miss subtle attacker behaviour that a skilled analyst can spot in minutes.
WatchTower threat hunting is a fixed-price, human-led engagement. We deploy our agent, collect 3-5 days of telemetry, and produce a written report with findings, risk ratings and concrete remediation steps.
Hunt types
- Persistence hunts. Scheduled tasks, WMI subscriptions, services and Run keys that do not match a known-good baseline for your estate.
- Lateral movement hunts. RDP and SMB connections between devices that should not communicate.
- DNS beaconing hunts. Low-and-slow C2 channels detected through DNS query entropy analysis.
What you get
- Agent deployment to your endpoints (5-minute installer, no reboot).
- 3-5 days of data collection and analysis.
- A written report with findings, risk ratings and remediation steps.
- A 30-minute read-out call.
- Option to convert to ongoing MDR at a discounted rate.
Fixed price from £1,500 for up to 50 devices.