Offensive mindset.
Defensive precision.
SPCI Security is a specialized cybersecurity operations firm. We attack systems to understand them, then engineer the defenses that stop those same attacks.
One team, both sides of the wire.
SPCI Security is a specialized cybersecurity operations firm. We attack systems to understand them, then engineer the defenses that stop those same attacks.
One integrated team covers the full spectrum: penetration testing and red teaming on the offensive side; detection engineering, EDR operations, threat intelligence, incident response and a 24/7 SOC on the defensive side. One accountable team, no hand-offs.
- 24/7Eyes on glass every day of the year
- Full stackFrom breaking in to keeping out, under one roof
- Code firstDetections, playbooks and controls shipped as tested, versioned code
Make adversary-grade security operational for every organization we protect.
Our mission
Six services. One operating team. No hand-offs.
Everything SPCI does, in one index. Each line opens the chapter that explains it.
Offensive
Defensive
Engineering
Delivered as managed services, co-managed with your team, or as focused engagements.
We break it before they do.
Compliance scans find checkboxes. Our operators find the path an attacker would actually take: chained vulnerabilities, weak identities, and the blind spots your tools never see.
- 01Penetration testingDeep, manual testing of web and mobile apps, APIs, external and internal networks, cloud estates and Active Directory. Every finding proven with evidence and ranked by business impact.
- 02Active Directory and identity attacksKerberoasting, delegation abuse, ADCS misconfigurations and privilege-escalation paths. Identity is the perimeter, so we hit it hardest.
- 03Red team operationsObjective-driven campaigns: initial access, persistence, lateral movement and exfiltration, run quietly to test your people and your detections.
- 04Cloud and SaaS attack surfaceMisconfigured IAM, exposed storage, over-privileged service accounts and tenant-to-tenant risk across AWS, Azure and Google Cloud.
Every offensive engagement ends the same way: findings converted into detections and hardening, not a PDF that gathers dust.
An EDR license is not a security program.
Value comes from deployment discipline, ruthless tuning, and analysts who know what attacker behavior looks like at 3 a.m.
- 01
Deploy
Full-estate rollout across Microsoft Defender, CrowdStrike, SentinelOne and comparable platforms, with health monitoring on every sensor.
- 02
Harden and tune
Policy baselines, custom detections layered on vendor telemetry, continuous false-positive reduction.
- 03
Monitor 24/7
Our SOC triages every alert, hunts across your telemetry and escalates only what is real and urgent.
- 04
Respond
Isolate hosts, kill processes and contain incidents through the EDR, backed by rehearsed playbooks.
- aIncident responseResponders who contain, eradicate and recover, with evidence preserved for what comes after.
- b24/7 SOCContinuous monitoring, triage and hunting, every day of the year.
- cThreat intelligenceCurated intelligence on the actors and campaigns that matter to you, fed straight into detections.
Endpoint, identity, cloud and network telemetry in one operation.
Detections you can read, test and own.
Most providers click rules together in a SIEM console and hope. We write detections the way software teams ship software: Sigma, KQL and YARA-L rules mapped to ATT&CK techniques, versioned in git, peer reviewed, and tested in CI/CD against attack simulations before they deploy.
Coverage is measured, not assumed, and when the engagement ends the repository is yours.
title: Kerberoasting: TGS Request With RC4 Encryption
id: 2e42b0d4-aa33-4c5f-8f8d-05b2505de41e
status: test
description: Detects Kerberos service ticket (TGS) requests that use RC4-HMAC (0x17) with forwardable and renewable ticket options, a common Kerberoasting signature. Excludes machine accounts and the krbtgt service.
references:
- https://attack.mitre.org/techniques/T1558/003/
author: SPCI Security
date: 2026-09-18
tags:
- attack.credential_access
- attack.t1558.003
logsource:
product: windows
service: security
detection:
selection:
EventID: 4769
TicketOptions: '0x40810000'
TicketEncryptionType: '0x17'
Status: '0x0'
filter_machine_accounts:
ServiceName|endswith: '$'
filter_krbtgt:
ServiceName: 'krbtgt'
condition: selection and not 1 of filter_*
falsepositives:
- Legacy service accounts or appliances that only support RC4
- Domains with a 2003 functional level
level: mediumRepository: yours. License: yours. Audit trail: complete.
- 01
Author
Sigma, KQL and YARA-L rules mapped to ATT&CK techniques
authored
- 02
Version
Git-backed repository with peer review and full audit history
reviewed
- 03
Test
CI/CD validation against attack simulations and log samples
ci passed
- 04
Deploy
Automated rollout to SIEM, EDR and cloud platforms
deployed
- 05
Measure
Coverage scoring, false-positive rates, drift alerts
measured
| Traditional detection | With SPCI Detection-as-Code |
|---|---|
| Rules edited by hand in SIEM consoles | Detections as reviewed, versioned code |
| No version history, so changes are invisible | Full audit trail of every change |
| Untested logic pushed straight to production | CI/CD pipelines validate before deploy |
| Alert fatigue from stale, noisy rules | Continuous tuning: precision up, noise down |
| Coverage gaps found only after an incident | ATT&CK coverage mapped, scored, reported |
Deliverables: private detection repository, CI/CD pipeline, ATT&CK coverage dashboard, quarterly efficacy reports.
Your models are production infrastructure.
LLMs, copilots and agents are a new attack surface. We wrap the same offensive testing, detection coverage and 24/7 operations around your models, RAG pipelines and agents.
- 01AI red teamingPrompt injection, jailbreaks, data extraction and tool abuse tested against your actual LLM apps and agents.
- 02Guardrails and runtime defenseInput and output controls, policy enforcement and monitoring wrapped around every model in production.
- 03Secure AI architectureIdentity, data boundaries and least privilege designed into RAG, fine-tuning and agentic workflows.
- 04AI threat detectionDetection-as-Code rules purpose-built for AI abuse, monitored by the same 24/7 SOC as the rest of your estate.
Aligned to the OWASP LLM Top 10. Run by the same operators, not bolted on by a generalist.
- LLM01Prompt Injection
- LLM02Sensitive Information Disclosure
- LLM03Supply Chain
- LLM04Data and Model Poisoning
- LLM05Improper Output Handling
- LLM06Excessive Agency
- LLM07System Prompt Leakage
- LLM08Vector and Embedding Weaknesses
- LLM09Misinformation
- LLM10Unbounded Consumption
The same loop, pointed at your models.
Emulate. Detect. Respond. Harden.
Defense is only as good as the attack it was built against. Every engagement runs a continuous purple-team loop.
- 01EmulateReplay real adversary TTPs against your environment
- 02DetectEngineer detections that catch the behavior, not the tool
- 03RespondContain and eradicate with rehearsed playbooks
- 04HardenFeed lessons back into controls, code and coverage
The loop never stops. Every attack we simulate makes the next detection sharper.
Built by the people who will run it.
- 01Operators, not vendorsPractitioners who have run offense and defense, embedded with your team and accountable for outcomes.
- 02Engineering firstEverything we build, from detections to guardrails, is code: tested, versioned and yours to keep.
- 03Measured relentlesslyATT&CK coverage, detection efficacy and response times reported openly, every quarter. Illustrative coverage map, 14 ATT&CK tactics
How we engage
- 01AssessThreat-model your environment, estate and AI footprint
- 02EngineerStand up detections, EDR baselines and pipelines
- 03Operate24/7 monitoring, response and tuning
- 04EvolveQuarterly purple-team loops and coverage reviews
Reported openly, every quarter.
Names we can give you.
Selected organizations SPCI protects today.
- CCI Call Center InternationalCustomer operations
- Eagle Star TransportationTransportation
- Lycée Louis MassignonEducation
- OnSite TransportationTransportation
- Tree CapitalInvestment advisory
References available on request.
Know your attack surface before someone else does.
Tell us what you are protecting. We reply within one business day.