Cybersecurity & digital forensics · Bengaluru, India

Find out what happened. Then fix what allowed it.

Sleuth Forensics tests environments before something goes wrong and investigates them after. Either way, the output is the same: evidence you can check, and recommendations your team can act on.

Start a conversation All 21 services

Practices: Security, Investigation, Resilience
Services: 21, across three practices
Based in: Bengaluru, Karnataka, India
Enquiries: Via the enquiry form

Evidence first. Everything we report is something we observed, recorded, and can show you.

Sleuth Forensics works with organisations across India to assess security controls, test for vulnerabilities, investigate suspicious activity, respond to incidents, and build resilience over time.

Assessment work is manual as well as automated, because the findings that change a decision are rarely the ones a scanner prints. Investigation work is documented as evidence, because sooner or later somebody senior will ask how you know.

02 · Services

Twenty-one services, three practices

Grouped by what the work is for: testing what you have, investigating what has already happened, and preparing for what comes next.

Security

Assess and strengthen

Test what you already have, find what is exposed, and prioritise the fixes that reduce real risk across infrastructure, applications, cloud, identity, and endpoints.

01 Cybersecurity Consulting & Advisory Strategic security guidance, programme development, and expert advisory for organisations building or improving their security capabilities. 02 Cybersecurity Audits & Security Reviews Systematic review of controls, configurations, policies, and practices to find gaps and measure effectiveness against established frameworks. 03 Vulnerability Assessment & Penetration Testing Identify and validate weaknesses through structured vulnerability assessment and manual penetration testing of your systems and applications. 04 Network Security Assessment & Testing Evaluate network architecture, segmentation, device configurations, and perimeter controls to identify exposure and lateral movement risk. 05 Web Application & API Security Testing Manual and automated testing of web applications and APIs for authentication, authorisation, injection, and business logic flaws. 06 OT Security Maturity Assessment Assess the security posture of operational technology and industrial control systems so physical processes stay safe and available. 07 Mobile Application Security Testing Assessment of iOS and Android applications: local data storage, communication channels, authentication, and runtime protections. 08 Cloud Security Assessment & Testing Review of cloud configurations, access controls, storage policies, and security practices across AWS, Azure, GCP, and other platforms. 09 Active Directory & Identity Security Assess Active Directory configuration, trust relationships, privilege escalation paths, and identity controls to reduce credential risk. 10 Endpoint Security Assessment & Hardening Evaluate endpoint configuration, security agent coverage, hardening baselines, and local privilege controls across workstations and servers.

Investigation

Establish what happened

Forensic examination, incident response, and threat hunting. Determine the scope, reconstruct the timeline, and document the result as evidence.

11 Digital Forensics & Cyber Investigations Structured forensic examination of digital evidence to establish facts, reconstruct events, and support organisational decisions. 12 Mobile Phone Spyware Detection Is someone else listening to your conversations? Detection of Pegasus, stalkerware, and stealth monitoring tools on iOS and Android. 13 Digital Forensics & Incident Response Combined forensic analysis and incident response: investigate the incident, determine scope, and guide recovery while preserving evidence. 14 Incident Response & Breach Investigation Response support during an active incident, including containment guidance, forensic triage, and breach scope determination. 15 Compromise Assessment & Threat Hunting Proactive search for indicators of compromise, persistent threats, and unauthorised activity that existing detection has missed. 16 Malware Analysis & Reverse Engineering Static and dynamic analysis of suspicious files to determine behaviour, capability, persistence mechanisms, and indicators of compromise.

Resilience

Prepare for the next one

Detection and response maturity, adversary simulation, compliance programmes, and security leadership without a full-time hire.

17 Ransomware Investigation & Readiness Test your readiness for ransomware, investigate active incidents, and build response playbooks and recovery strategies. 18 Threat Intelligence & Attack Surface Monitoring Monitor your external attack surface, track relevant threat actor activity, and surface exposed assets and leaked credentials. 19 Security Operations, SIEM & SOC Consulting Design, evaluate, and improve security operations: SIEM deployment, detection engineering, and SOC process maturity. 20 Red Teaming & Adversary Simulation Objective-based adversary simulation that tests detection and response against realistic attacks on your critical assets. 21 Cybersecurity Compliance, GRC & vCISO Compliance programme development, governance and risk management, regulatory alignment, and virtual CISO support.

Full services index

03 · Method

How an engagement runs

Six phases, in order. The scope changes from one engagement to the next; the sequence does not.

Understand

Establish the environment, the business context, and the specific concern that prompted the engagement. Scope follows from this, not the other way round.

Examine

Review systems, configurations, controls, evidence, and telemetry. Manual work where it matters, tooling where it scales.

Analyse

Correlate findings across sources, separate noise from real risk, and establish what an issue would actually mean in your environment.

Report

Set out the evidence, severity, business impact, and prioritised recommendations, in one document that reads at both technical and board level.

Improve

Work through remediation with your team: practical guidance and a roadmap that accounts for what you can realistically change.

Validate

Retest the fixes. A finding is closed when we can show it is closed, not when a ticket is marked done.

04 · Deliverables

What lands on your desk

Reports follow the same structure every time, so findings can be compared across engagements and passed between audiences without being rewritten.

01Executive summary
02Scope and methodology
03Detailed findings
04Evidence and proof of concept
05Risk and impact rating
06Remediation guidance
07Business impact analysis
08Prioritised roadmap
09Technical appendices

05 · Approach

What we hold to

Evidence over assumption

Every finding states what was observed, where it was found, and why it matters. If we cannot show it, we do not report it.

Depth beyond the scanner

Automated tools open the engagement, they do not close it. Business logic flaws, chained weaknesses, and attack paths are found by hand.

Written for two audiences

The same report has to work for the engineer who will fix the issue and the director who has to fund the fix. We write both parts properly.

Confidentiality by default

Assessments and investigations surface things organisations would rather not have in circulation. Engagement data is handled accordingly.

Where we work

Technology & SaaS
Financial services
Healthcare
Manufacturing
Professional services
Retail & e-commerce
Education
Government & public sector

Industry detail

Suspect a compromise?

Tell us what you are seeing and mark the enquiry urgent. We read those first, and we will say plainly whether we are the right people for it before anything else is agreed.

Send an enquiry How DFIR engagements run