About
A practice built around evidence
Sleuth Forensics helps organisations understand where they are exposed, investigate what has already happened, and put the results to work.
01 · Mission
Effective security depends on knowing what is actually happening in your environment, not what might theoretically go wrong.
The practice combines technical security assessment with investigative capability. That combination is deliberate: the same skills that reconstruct an intrusion after the fact are the ones that find the path to it beforehand.
Work spans preventive security such as assessments and testing, reactive investigation when an incident occurs, and longer-term advisory to build resilience. Clients range across technology, financial services, healthcare, manufacturing, and the public sector, in India and for Indian operations of international organisations.
02 · Principles
What guides the work
Evidence over assumption
Every finding states what was observed, where it was found, and why it matters. Speculation is labelled as such or left out.
Clarity in communication
A technical finding is only useful if the person who has to act on it understands it. Reports are written for the engineer and for the board, in the same document.
Practical improvement
Recommendations account for operational reality: what your team can implement, measure, and keep running after we have gone.
Confidentiality and trust
Security engagements surface sensitive material. Engagement data is handled with the care that implies, during the work and after it.
03 · Method
How engagements run
Six phases, in order, whether the engagement is a two-week test or a live incident. Each phase has a defined output, so there is never a question about what stage the work is at.
Understand
Establish the environment, the business context, and the specific concern that prompted the engagement.
Examine
Review systems, configurations, controls, evidence, and telemetry. Manual work where it matters, tooling where it scales.
Analyse
Correlate findings across sources, separate noise from real risk, and establish what an issue would mean here.
Report
Set out evidence, severity, business impact, and prioritised recommendations in a single document.
Improve
Work through remediation with your team, with a roadmap that accounts for what you can realistically change.
Validate
Retest the fixes. A finding is closed when it can be shown to be closed.
04 · Capability
Three practices
Next step
Tell us what you are dealing with
An assessment, an investigation, or a question about where to start. The first conversation costs nothing and usually clarifies the scope quickly.