The CyCraft Advantage
It has been a quiet day in the security operations center so far. The chatter overpowers your noise-canceling headphones; even Bob from Accounting stops by to say hi and tell you his latest joke. You might just take an extra-long lunch break today. Then it happens. Everyone goes dead silent as their computers are overwhelmed by wave after wave of alerts.
Is this alert accurate? Is it severe? How does this alert relate to everything else? What should we do? Did we miss anything? You know this song and dance. Alert. Investigate. Remediation. Doubt. Double-check. There is nothing left to do but go over each and every alert one at a time.
Or is there?
CyCraft prioritizes alert severity, automates investigations, and delivers actionable reports with contextual information, including the true root cause of the attack. Eliminate the guesswork with the CyCraft Advantage.
Prioritized Alert Severity
Our platform is a dual-cadenced system: severe alerts and regular reports. Our platform prioritizes alerts by severity; 10 being a severe malicious activity such as fileless attacks, and 1 being a low-severity activity such as Bob from Accounting playing Starcraft. As soon as an alert with high-severity is detected, our platform notifies you immediately, so you can respond immediately. In minutes, we can deliver you a full site forensic analysis, linking all the parts of the attack together.
Actionable Reports
Our full site analysis includes the full context behind the high-severity alerts that were previously sent. Your full site analysis report provides actionable intelligence covering your endpoints, processes, files, identity and access management (IAM), and your network. We automate forensic investigations. We replace guesswork with actionable intelligence. Your actionable report informs you which processes to stop, which files to delete, which malware to remove, which user accounts were infected and need resetting, and which URLs, IP addresses, and domains to block. And our platform offers remediation options to boot.
Our Deliverables
- Full comprehensive storyline of all hacker activity
- Analysis of the true root cause of the attack
- Malicious domain, IP, URL analysis
- List of behavior of suspicious user accounts
- Malware analysis
- Graphs of all affected nodes and executions
- A plan for eradication
- MITRE ATT&CK® mapping & much more
Your actionable report provides a comprehensive attack storyline that meticulously goes over each step of the attack process by process, from the first initial access to the last malicious process. Your attack storyline not only gives you the broadest perspective on the attack, allowing you to see the big picture but also dive down into finer details of the attack. See where the attackers went, what they did, and how they did it — step by step with relevant ATT&CK® technique. The most important node of your organization-level attack storyline is the first — the true root cause of the attack.
True Root Cause & Full Scope of Attack
All too often, EDR vendors will claim to be able to track down the “root cause” of the attack. However, the attack on your organization may not have originated on that particular endpoint. We provide you with the true root cause of the attack — where the attackers first gained illegal access to your organization.
Locating the true root cause is the first step in containment. Once located, our continuous forensics begins detecting every malicious process of the attack and constructing your complete attack storyline. We spot every move.
Our continuous forensics heavily monitors lateral movement. If an attacker accesses an endpoint, we will detect it. If an attacker attempts to access a healthy endpoint from a compromised one, we will detect it. We even show you hidden devices that hackers may have leveraged that you don’t know about.
Monitoring lateral movement allows us to provide you with complete contextualized information. We will not only inform you which endpoints have been compromised but also how each malicious event relates to each other.
How can CyCraft provide continuous forensics so fast?
Our patented CyCraft AIR platform includes:
- Multi-context forensic evidence analyses: artifact, endpoint, user, & network
- Correlation of all evidence across your entire site & with multi-source global threat intelligence
- And additional logic modules such as UEBA, NGAV, and over 50 AI threat hunting algorithms
- Proprietary threat intelligence
- Automated cyber forensic procedures
- Industry-recognized forensic analysts working with our AI platform
Who are we?
CyCraft is the leading cybersecurity firm in Taiwan, a country that receives an estimated 30 million cyberattacks a month — 60 percent of which target government agencies.
CyCraft, while only in its third year, has been rapidly expanding across Asia. It’s no surprise that CyCraft outperformed all other cybersecurity vendors in Asia in the Cybersecurity Excellence Awards. CyCraft was one of only two cybersecurity vendors from Asia selected to join the second round of the MITRE ATT&CK Evaluations against their APT29 emulation.
As of 2020, CyCraft secures government agencies, Fortune Global 500 firms, top banks and financial institutions in Asia, critical infrastructure, airlines, telecommunications, hi-tech companies, and SMEs in several APAC countries, including Taiwan, Singapore, Japan, Vietnam, and Thailand. We power SOCs with our proprietary and award-winning AI-driven MDR (managed detection and response), SOC operations software, threat intelligence, Health Check, automated forensics, and incident response services.
Read our use case on how CyCraft Technology helped one of the top four fabless semiconductor manufactures save 95 percent in workforce costs and reduce investigation time of a pre-acquisition due diligence digital forensic investigation by 99 percent, with a 95% cost reduction.
Gain insight into our technology by reading how a simplified version of one of our many sophisticated machine learning algorithms was able to defeat an advanced threat in our six-part Fuchikoma series.
