Expertise
How we build, how we defend
Open components, assembled the same way on every engagement — handed over with detection and response already running.
How we build
Our infrastructure stack
Open components, assembled the same way on every engagement, so the platform can be operated by the client team — or by ours, as a managed service.
Compute & virtualisation
Proxmox VE · KubeVirt · Talos Linux (immutable nodes)
Orchestration
Kubernetes · Helm · workload packaging and release management
Delivery & operations
ArgoCD · GitOps · industrialisation of legacy docker-compose estates
Network & storage
Cilium (eBPF networking and observability) · LINSTOR replicated block storage
AI & governance
On-premise inference and RAG · shadow-AI inventory and remediation
Managed operations
Managed cloud by subscription · upgrades, tested backups, monitoring, capacity and cost control
Kubernetes
Proxmox VE
KubeVirt
Talos Linux
ArgoCD
Helm
Cilium
LINSTOR
Backups
How we defend
Detection and response
We deploy and operate the Cyfox Software SecOps platform on the infrastructure we build. Built on open source. Deployable on-premise. Same sovereignty rule as the infrastructure underneath.
Endpoint
EDR (Wazuh-based)
Full endpoint telemetry with prevention, detection and response, YARA rules and active response.
Telemetry
Advanced SIEM
Elasticsearch with Graylog ingestion, Sigma rule detection and cold storage for long retention.
Network
Network detection
Zeek sensors feed network telemetry into the SIEM, so lateral movement shows up next to endpoint events.
Intelligence
Threat intelligence
Over 1M IoCs from real-time feeds, enriched automatically through MISP and OpenCTI.
Automation
SOAR automation
Playbooks and custom runbooks that take incident response from hours to seconds.
Operations
Case management
Alert-to-case automation with a full audit trail, on Grafana dashboards enriched with MITRE ATT&CK.
Cyfox Software Ltd. is a third-party platform. Network-side detection comes through its Zeek integration, not a separate NDR product.
A platform your team can operate
Standard, documented, reversible foundations — operated by your team or by ours, as a managed service.