Four disciplines · One team
Threat intelligence, VAPT and 24×7 SOC. One team.
O2 Intel is a cyber security practice built around a single loop: find what's already exposed with continuous threat intelligence, prove what an attacker could do with it through manual penetration testing, watch it around the clock from our SOC, and contain it with retained incident response. Most companies buy those four from four vendors and spend their week reconciling the answers.
Intelligence · Testing · Monitoring · Response
Find it. Prove it. Watch it. Contain it.
The exposure loop, run by one team
Six service lines, one accountable team.
Take one, or take the loop. What changes when you take more than one is that the findings stop arriving in separate formats from separate companies — the people who found the exposure are the people who test it and the people watching for it.
Threat Intelligence
Continuous collection across the surface, deep and dark web — correlated to your assets, not to a generic feed.
- Dark web & marketplace monitoring
- Credential & infostealer log exposure
- Brand, domain & executive impersonation
- External attack surface discovery
- Threat actor & ransomware tracking
- Curated IOC / TTP feeds (STIX, MISP)
VAPT
Manual, exploit-led testing against your applications, infrastructure and cloud — with proof, not a scanner export.
- Web application & API testing
- Network & infrastructure penetration testing
- Cloud configuration review (AWS, Azure, GCP)
- Mobile application testing (iOS, Android)
- Red team & assumed-breach exercises
- Secure code & architecture review
SOC as a Service
Round-the-clock monitoring, triage and escalation, run by analysts who work your estate rather than a queue of a hundred.
- 24×7×365 alert triage
- Detection engineering & tuning
- Log pipeline & SIEM management
- Proactive threat hunting
- Managed EDR / XDR response
- Monthly posture & coverage reporting
Incident Response & DFIR
When something does land, containment starts on the call — not after a scoping cycle and a purchase order.
- Retainer with a committed response window
- Host, memory & cloud forensics
- Infostealer & account-takeover investigation
- Containment & eradication support
- Root cause and post-incident report
Advisory & Compliance
The programme layer — audits mapped to the evidence our own testing and monitoring already produce.
- ISO 27001 & SOC 2 readiness
- Gap assessment & policy authoring
- Third-party / vendor risk review
- Phishing simulation & awareness training
- vCISO advisory retainer
Product — O2 Radar
Our own credential-exposure platform, built in-house and used on every intelligence engagement we run. Licence it directly, or get it as part of the practice.
- Continuous credential-exposure monitoring
- Self-hosted or run by us
- Feeds the SOC and testing teams directly
Collection is cheap. Correlation is the product.
Anyone can sell you a feed. The work is deciding which of the day's ten thousand records touches an asset you actually own — and handing that one to a team who can act on it the same week.
Collect
Breach corpora, infostealer logs, paste sites, marketplaces, ransomware leak blogs, closed channels and certificate transparency — ingested continuously.
Correlate
Records are matched against your registered domains, subdomains, brands and executives, and deduplicated so the same finding cannot reach you twice.
Prioritise
An analyst ranks what survived by exploitability and asset value, and writes the reason down. You get a judgement you can challenge, not a number to trust.
Act
Straight to whoever owns it — your team, our SOC, or our testers if it's worth proving out. Delivered to Slack, webhook, email, or STIX/MISP for your own tooling.
A finding without an exploit is a guess.
Every engagement is manual and exploit-led. You get a reproduction path, the impact in your terms, a fix, and a free retest once you've shipped it — mapped to OWASP ASVS, WSTG, PTES and MITRE ATT&CK.
| Engagement | What we go after | Typical window | Deliverable |
|---|---|---|---|
| Web & API | Authn/authz bypass, IDOR, injection, business-logic abuse, SSRF, session and token handling. | 1–3 wks | Report + retest |
| Network & infra | External and internal perimeter, lateral movement, privilege escalation, exposed services and legacy protocols. | 1–2 wks | Report + retest |
| Cloud review | IAM policy sprawl, public storage, key material in metadata, network exposure, logging and detection gaps. | 1–2 wks | Config baseline |
| Mobile | Local storage and keychain, certificate pinning, runtime tampering, backend API parity. | 1–2 wks | Report + retest |
| Red team | Objective-led, assumed-breach or full-scope. Phishing, credential reuse from live exposure intelligence, detection evasion measured against your SOC. | 3–6 wks | Attack narrative |
| Code review | Secrets in history, dependency and supply-chain risk, authorisation logic, cryptographic misuse. | 1–2 wks | Annotated diff |
Severity you can defend
CVSS v4 as the baseline, then adjusted for your environment — an admin panel behind mTLS is not the same finding as one on the open internet.
Findings land where you work
Straight into Jira, Linear or GitHub Issues with the reproduction attached. No PDF-to-ticket transcription.
Retest is included
Fix it, tell us, and we re-run the exploit path. The report only closes when the exploit stops working.
Someone is watching at 3am. It isn't you.
Analysts on rotation who know your estate — so an exposure finding and an endpoint alert on the same host arrive as one incident, not two tickets in two tools from two suppliers.
We built the tool we needed.
Continuous credential-exposure monitoring — the platform our own intelligence team runs on every engagement. It scores what leaked by how much it actually matters, catches stolen credentials on employee machines, and pages you only on what's new. Licence it on its own, self-host it, or let us operate it as part of the practice.
Visit O2 RadarStart with one line. Add the loop when it earns its place.
Pick what you're weighing up and this sketches the shape of the programme — the tracks it breaks into, the cadence each runs at, and where the first month goes. It's a starting point for the conversation, not a quote.
What are you considering?
Shape of the programme
You are handing us your worst day. Here's how we hold it.
A security practice accumulates the most sensitive material a company has: what's broken, what leaked, and where. How that's handled is part of the service, not an appendix to it.
Least privilege, always
We ask for the narrowest access that lets the work happen, time-boxed to the engagement and revoked at the end.
Named analysts
You know who is on your account. Work is attributed, and every access to your findings is logged and reviewable.
Findings stay yours
Reports and evidence are encrypted in transit and at rest, shared only with the people you name, and deleted on the schedule you set.
Self-hosting available
Where you would rather nothing left your estate, our tooling can run inside it — including O2 Radar.
No credential hoarding
Stolen credentials surfaced during intelligence work are reported by location and severity, never retained in the clear.
Clean exit
Leave and you take the evidence with you — exports in open formats, access revoked, retained data destroyed on confirmation.
What people ask before they call.
What is threat intelligence, and how is it different from buying a feed?
A feed is raw records. Threat intelligence is those records correlated to assets you actually own, ranked by an analyst who writes down the reasoning, and delivered to whoever can act on it. We collect from breach corpora, infostealer logs, marketplaces, ransomware leak sites and certificate transparency, then hand you the handful that touch your estate.
What does a VAPT engagement include?
Manual, exploit-led vulnerability assessment and penetration testing across web applications and APIs, network and infrastructure, cloud configuration, and mobile apps, plus red team and assumed-breach exercises. Every finding ships with a reproduction path, environment-adjusted severity, and a fix — and a retest is included, so the report only closes when the exploit stops working.
How quickly does your SOC respond to an alert?
Our SOC as a Service runs 24×7×365 on a tiered model: Tier 1 opens and enriches every alert against a 15-minute triage target, Tier 2 investigates across hosts and identities against a 30-minute escalation target, and Tier 3 handles hunting, detection engineering and DFIR. Nothing is silently auto-closed.
Do you offer an incident response retainer?
Yes. A DFIR retainer agrees the contract, comms path and response window before anything happens, so containment starts on the call rather than after a scoping cycle and a purchase order. It covers host, memory and cloud forensics, infostealer and account-takeover investigation, and a root-cause report.
What is O2 Radar, and do we have to use it?
O2 Radar is our own credential-exposure monitoring platform, built in-house and used on every intelligence engagement we run. You can licence O2 Radar directly, self-host it inside your own estate, or have us operate it as part of the practice. It is not a requirement for any other service line.
Can we start with one service and add others later?
That is the usual path. Most engagements begin with an exposure assessment, and service lines are added as they earn their place. The advantage of adding them here rather than elsewhere is that the people who found the exposure are the people who test it and the people monitoring for it — no handover between vendors.
Start with the exposure you already have.
Most conversations begin the same way: we look at what's already leaked about your organisation, and you decide what to do about it. No commitment to the rest of the practice.