Capabilities Statement 2026

Core capabilities

SIEM architecture and engineering. Design, implementation and optimization of Splunk, Microsoft Sentinel, Securonix, QRadar, Elastic and Devo environments. ATT&CK-driven data-source gap analysis, detection-as-code pipelines and measurable reductions in alert fatigue.

Security data-platform engineering. OCSF-normalized security data lakes, federated search via Caver, detection-as-code with backtesting, and cloud-native log pipeline architecture on AWS, Azure and GCP. Detection-content migration from Sigma, Splunk, Elastic, Sentinel, QRadar and Defender into Caver, with a coverage report on what did and did not carry.

AI-augmented security operations. LLM-assisted detection authoring, automated alert triage, incident summarization and analyst force-multiplication through Etairos, RedEye's AI and automation division. RAG-enabled threat-hunt workflows and agentic response runbooks.

vCISO and cybersecurity program management. NIST CSF 2.0 program leadership, risk register, governance cadence and executive reporting. Annual risk assessments, tabletop exercises, phishing simulation and workforce training aligned to compliance requirements.

Vulnerability assessment and penetration testing. IT network, application and cloud-infrastructure testing with exploitability-weighted, prioritized remediation. Zero Trust architecture review and DevSecOps integration.

Threat intelligence and research. Continuous collection on exposed attack surfaces and active campaigns. CVE and CISA KEV correlation against client-specific environments, adversary profiling and ATT&CK-mapped coverage-gap analysis. RedEye is a CVE Numbering Authority.

ICS / OT security, the niche specialty. Active and passive scanning and decoded-protocol monitoring for Modbus, DNP3, EtherNet/IP, OPC UA, BACnet, S7comm, IEC-104, IEC 61850 (GOOSE/MMS) and PROFINET. CISA KEV correlation for industrial assets, IEC 62443 architecture, and engagement models aligned to federal grant programs (CWSRF, DWSRF, FEMA HSGP) for water and energy utilities.

RF-layer OT monitoring. Rural and remote OT sites report over unlicensed SCADA radio, a link that is before the firewall, outside every network segment and never on the internet. RedEye senses that spectrum with a receive-only sensor that never transmits, decodes the traffic (with the customer's own radio key where a link is encrypted) and correlates it with network and log telemetry on one timeline. Delivered today as an OT radio assessment; continuous in-platform monitoring is in development.

Telecommunications security and AI voice. Security architecture for VoIP, SIP and WebRTC infrastructure. AI-powered call handling, natural-language IVR and real-time transcription through CallingEdge.

Continuous monitoring and incident response. OCSF-normalized telemetry ingestion, asset-aware enrichment and SOC-workflow integration. Managed detection and response with Carbide EDR. Incident response planning, tabletop exercises and signed-PDF regulatory reporting (EPA, AWIA, NJCCIC).