Most security firms observe and report. We detect, verify, and fix.
A working incident-response practice — not a report factory, not a bench-time reseller.
Engagements ship with chain-of-custody evidence your insurer and counsel can use without reconstruction, produced by AI-augmented tooling we build and hold the patents on.
See what we see. Before you talk to us.
Scan my domain →Run our free external-surface scan against your domain. Eleven intel sources — Shodan, GreyNoise, DMARC/SPF/DKIM, breach corpus, crt.sh, and more — the same pre-engagement pass we run before every CRS engagement.
What we do
Three service lines. One operator on every engagement.
We don't split our practice into consulting versus IR versus forensics silos with different hand-off teams. The same person who scopes your assessment is the person on the incident bridge.
Active & post-incident
Incident response
Business email compromise, AiTM session theft, persistence hunting, and containment across Microsoft 365 and hybrid estates. We don't stop at the alert — we run the investigation to the end and fix what let it happen.
What we do inside the hour
- Contain the identity — revoke sessions, disable inbox rules, reset MFA, pull tokens.
- Map the blast radius — every sign-in, every mailbox rule, every OAuth grant since the earliest anomaly.
- Preserve the evidence — hash-sealed capture of audit logs, sign-in logs, and mailbox exports before anything gets purged.
What ships when it's done
- A chain-of-custody bundle your insurer and counsel can rely on without reconstruction.
- The configuration change that closes the gap that let this happen.
- A specific finding for every alert your incumbent provider missed, ignored, or auto-closed.
Insurer- and counsel-ready
Digital forensics & evidence
Audit-log reconstruction, mailbox eDiscovery, and second-opinion reviews of incidents someone else already closed. Every case folder ships cryptographically sealed with an independent verification script.
Where we're strongest
- Microsoft 365 — Unified Audit Log, mailbox rules, OAuth grants, sign-in logs, guest activity.
- Browser forensics — history, downloads, cookies, tracker chains — our own tooling, patent-backed.
- Session-chain reconstruction — the sequence of pages, redirects, and downloads that led to initial access.
- Second-opinion review — when the incumbent said "handled" and something still feels wrong.
The seal we ship
Signed manifest of every file in the case folder, RFC 3161 trusted timestamp, and an independent verification script so any recipient can prove the evidence hasn't been altered. That's the deliverable; the report is just the summary of it.
Prevent the next engagement
Security consulting
CA and identity hardening, email authentication (DKIM/DMARC), privileged-access review, and SIEM coverage-gap — the configuration work that decides whether the next attack is an incident or a log entry.
Where we start
- Conditional Access review — conflicts, gaps, eval-order surprises. The CA-that-never-fired pattern is our specialty.
- Identity hardening — MFA coverage, PIM, break-glass hygiene, service-principal audit.
- Mail security — DMARC/SPF/DKIM, spoof-sender lockdown, anti-phishing policy tuning.
- SIEM coverage-gap — what your Splunk or Sentinel is NOT catching, ranked by threat model.
- Compliance framing — NIST 800-171 / CMMC / CIS-18 mapping when you need it.
From the case files · anonymized real engagements
Each one started the same way: the MSS said it was handled.
How we deliver — the Envyously platform
Our production stack, not a marketing lineup.
We built it, we run every engagement on it, and our parent company holds the provisional patents on the parts that matter. Hiring CRS means getting six-figure tooling on day one of the engagement.
Multi-tenant SOC console
Envyously WatchTower
Cross-vendor alert normalization — Microsoft Defender, CrowdStrike Falcon, Duo, Okta, SentinelOne, Splunk, ConnectWise, IT Glue — on a single operator pane. Every tenant we watch gets a morning brief. Every alert lands in one queue instead of six portals.
Chain-of-custody forensics
Envyously Trace
Digital-forensics stack for browser artifact reconstruction and session-chain analysis. Every case ships a hash-sealed evidence bundle built for insurance claims and legal proceedings — not a PDF of screenshots. Independent verification script travels with the bundle.
Sandboxed analysis
Detonation Chamber
Suspicious attachments and URLs detonate inside an isolated VM with SSL-decrypted network capture, per-case snapshots, and REMnux integration. You see what the payload actually does, not what a reputation score guesses.
Voice-controlled SIEM · patent 64/078,567
Speak-Splunk
A voice-driven Splunk console for ops-speed queries mid-incident. Customers with their own Splunk can operate it by voice — no SPL required to ask what happened.
Local AI archive
Beast RAG
Source-cited answers over your historical PDFs, invoices, and incident writeups — running locally. No data leaves your VM, and every answer links back to the document it came from.
Pre-engagement OSINT
Envyously Prospect Intel
External-surface enrichment across Shodan, GreyNoise, crt.sh, AbuseIPDB, HIBP, DNS Twist, URLScan, Wayback, OTX, Wappalyzer, and Apollo — we know your exposure before the first call.
Cloud & vendor procurement
The firm that hardens your tenant can also license it.
CyberRisk Services is a Sherweb cloud-solution partner. That means the firm that hardens your tenant can also be the channel that licenses it — Microsoft 365 seats, security add-ons, cloud infrastructure, and vendor tools we recommend during an engagement.
One relationship, one invoice, no double-brokerage — and the person configuring the product is the person who chose it. We don't push shelfware.
Through the Sherweb channel
- Microsoft 365 licensing — CSP channel, commercial NCE
- Sherweb Performance Cloud — private VDC / vCloud infrastructure
- 300+ vendor marketplace — security, backup, email protection
Direct to ownership
Start a conversation.
One principal answers. Same-business-day reply. Mid-incident? Put ACTIVE INCIDENT in the subject line — it jumps the queue.
How we work
"Operator-led" gets used as marketing copy. Here it's literal. The principal who answers your first email is the person on the incident bridge, the person pulling sign-in logs at 2 a.m., the person who detonates the sample. No intake tier, no junior rotation, no "your case has been escalated."
Why small
Our capacity is a design choice. We take few enough engagements that the operator is personally available for all of them. A firm of one that answers beats a firm of two hundred that queues.
What we ship
Every engagement closes with a cryptographically hash-sealed case folder and an independent verification script, so an insurer, auditor, or attorney can rely on the evidence without reconstruction. The tooling behind that deliverable is ours — commercialized as Envyously, backed by 10+ US provisional patents.