Can’t tell if there’s impact
Suspicious logins or alerts, but no way to judge scope or severity.
INCIDENT RESPONSE
Can you explain what happened —
with evidence?
Our analysts investigate logs and sources including the dark web, then set out what can be confirmed and what to do next. We start with a scoped initial investigation and propose further work only when it is needed.
Sound familiar?
What you need to decide isn’t more data — it’s confirmed facts.
Told your data is leaked
Someone says your data is on the dark web, but you can’t tell if it’s real or relevant.
Unsure what to tell people
You don’t know what to explain, and how far, to management or customers.
How we investigate
From thousands of log lines to evidenced facts.
We pull out the relevant traces, link the indicators, and report what is confirmed, what is inferred and what is still unverified, kept clearly apart.
Investigation services
Additional work starts only after you approve scope and cost. Nothing moves forward or is billed automatically.
Pricing depends on scope — contact us for details.
Dark-web sources and the intelligence we collect
We continuously monitor, in many languages, the places where attackers actually share and trade information.
Main sources (examples)
- Russian- and Chinese-language hacker forums
- Dark-web forums and leak sites
- Paste sites
- Multilingual Telegram hacker channels, including private channels
- Infostealer logs (data taken from malware-infected machines)
- Premium threat intelligence on APT (targeted attack) groups
What we collect and verify
- Victim company details attackers mention, including screenshots and proof
- Leaked employee and user credentials
- Zero-days and vulnerabilities being exploited
- Data leaks and company network access for sale
- Compromised CCTV cameras and IoT devices
- Mentions of leaked credit card data
- Lists of hacked or defaced websites
Sources are examples, not a complete list. All research is carried out within the law and our policy. We can explain specific sources during a consultation.
What we check and report
Written to be usable by executives and stakeholders, not just technical staff.
Facts
What can be confirmed from the logs and agreed sources.
Evidence
For each finding, the supporting log or source and when it was checked.
Confidence
“Confirmed”, “likely” and “unconfirmed” are kept separate. A leaked-data posting is never confused with a breach.
Next steps
What to do now, and what to check if further investigation is needed.
AI assistance, expert verification
AI helps organise logs, spot patterns, build timelines and draft reports. Final assessments are made by Pipeline analysts against the underlying evidence; AI suggestions are never treated as findings. Your logs are received by approved secure methods and handled in a controlled workflow.
How it works
01 STEP 1
Consultation
Tell us what happened, which systems, and what you need to know.
02 STEP 2
Agree scope
Targets, period, sources and deliverables. Logs received securely.
03 STEP 3
Investigate
Analysts investigate with AI assistance and re-check key evidence.
04 STEP 4
Report and decide
We report and plan next steps with you. Further work only if needed.
PLANS
Two ways to contract, to match how you prepare
An annual retainer that secures response capacity for the year, or tickets you use only when needed. Both agree scope and cost up front, so you can choose what fits your budget and approval process.
- First response within 4 business hoursContracted customers get a first response within 4 hours during business hours (weekdays 9:00–18:00 JST).
- 24/7 available on requestNight and weekend coverage is available under an agreed SLA.
- No surprise costsScope and cost are agreed before work starts. Nothing is billed automatically.
- Nothing goes to wasteUnused investigation capacity or tickets convert to prevention work or security training.
Retainer plans
Light
Get a response arrangement in place
- Contract and onboarding in advance
- First response within 4 business hours
- Investigations scoped and priced when requested
Standard
Investigation and prevention together
- Everything in Light
- Annual investigation capacity
- Unused capacity converts to RiskSensor ERI checks and more
Premium
From monitoring to investigation
- Everything in Standard
- Managed threat monitoring (ThreatIDR)
- 24/7/365 monitoring with our SOC partner
- Tabletop incident response exercise
Which should I choose?
| Annual retainer | Tickets | |
|---|---|---|
| Best for | Securing year-round capacity / handing off monitoring through investigation | Starting small / asking only when needed |
| Cost model | Fixed annual budget | Per ticket, pay for what you use |
| Preparation | Onboarding reviews your environment in advance | Scope confirmed with each request |
| Threat monitoring (ThreatIDR) | Included in Premium | Can be combined on request |
| Unused capacity | Converts to prevention (external risk checks, exercises) | Converts to training and workshops |
Pricing depends on scope. Not sure which fits? Tell us your situation and we’ll recommend one. Pilot (PoC) engagements are also available.
MANAGED MONITORING
Managed threat monitoring (ThreatIDR)
Continuous DNS-level monitoring for malicious traffic such as C2 communication and signs of malware infection. Threat intelligence updates every 60 seconds and detected malicious traffic is blocked automatically. When signs appear, Pipeline analysts move straight to investigation.
Detect and block
C2 traffic, malware and ransomware, phishing, botnet traffic and DGA attacks — blocked before they reach endpoints.
24/7/365 monitoring
Round-the-clock monitoring with our SOC partner.
From detection to investigation
Important signals are investigated by Pipeline analysts to establish scope and next steps.
The platforms behind our investigations
DatalaiQ
A data lake for searching and analysing logs at scale. Interop Tokyo 2022 Best of Show Award winner (Security). Used in our own investigations.
RiskSensor
To prevent recurrence: keep checking external risk and record improvements.
Frequently asked questions
What do I need to prepare?
What happened, which systems, when, what you need to know, and which logs you already have. We’ll suggest how to start.
Can I stop after the initial investigation?
Yes. Further work is proposed only when needed, with reasons, and starts only after your approval.
How are logs handed over?
Through approved secure methods, handled in a controlled workflow.
Does AI decide the findings?
No. AI assists with organising and timelines; Pipeline analysts make the final assessment from the evidence.
Do you cover nights and weekends?
Contracted customers get a first response within 4 hours during business hours (weekdays 9:00–18:00 JST). 24/7 response is available under an agreed SLA. Managed monitoring runs 24/7/365 with our SOC partner.
Retainer or tickets — which is better?
Choose the retainer to secure year-round capacity; choose tickets to start small or ask only when needed. We’ll recommend one based on your situation.
What happens to unused capacity or tickets?
They don’t go to waste: retainer capacity converts to prevention work, and tickets convert to training and workshops.
Request an investigation
Tell us what happened or what you’ve been told, and what you need to confirm. We’ll suggest the right way to start.
Email：[email protected]
Your information is handled under our privacy policy (Japanese).
Scope and limitations
- Investigations are carried out within the agreed targets, period, sources and objectives. Results depend on the availability, completeness and quality of logs, and do not guarantee root cause or the full extent of a compromise.
- Unless agreed separately, endpoint/disk forensics, malware analysis, large multi-system forensics, recovery or configuration changes, emergency on-site response and legal opinions are not included.
- Dark-web investigations do not include recovery or removal of leaked information.
- Scope, data required, timing, deliverables, data retention and fees are confirmed in a quote or statement of work (SOW).