About Strand
Strand Intelligence is a UK-based automated digital forensics and incident response platform that investigates security incidents for IR firms, critical national infrastructure, regulated enterprises and government.
EDR tells you something happened. Strand tells you how it happened, what was affected and whether the attacker is still there, with the evidence for each finding.
Collect evidence from endpoints, servers and cloud tenants, including Microsoft 365, Entra ID, Azure and Google Workspace. Existing KAPE and Velociraptor collections, plus EDR and SIEM telemetry, can join the same investigation.
Reconstruct initial access, lateral movement, persistence, data impact and root cause. Strand brings the evidence together into a single timeline and links findings to their sources with a confidence level.
Generate reports for executive, technical, legal and client audiences. Analysts retain judgement and final conclusions, and IR firms can deliver reports under their own brand.
Run daily forensic threat hunts across the cloud estate, including when no alert has fired. Each hunt produces a dated, evidence-backed record aligned to the NCSC Cyber Assessment Framework.
Strand’s collectors can be deployed during a response, so an investigation does not depend on the client’s existing telemetry. Teams can also bring collections they already hold.
Every finding links to supporting evidence and a confidence level. Analysts retain the judgement and final conclusions while Strand automates the investigation work.
Strand supports the firm’s analysts rather than competing as an IR service. White-labelled reports and per-investigation pricing support incident-driven work.
Daily compromise assessments look for what the SOC or MDR may have missed. Evidence supports assurance and reporting; accountability for compliance remains with the organisation.
01
Deploy Strand’s collectors or ingest existing collections and security telemetry from the affected environment.
02
Strand correlates the evidence, builds the timeline and investigates root cause, persistence and data impact.
03
Analysts retain final judgement, with evidence-linked findings and reports for the people who need answers.
Strand was built for responders who need defensible answers fast. The founders combine hands-on DFIR experience, regulatory investigation background and enterprise software delivery.
Co-Founder
Chief Executive Officer
Regulatory investigations at the ICO, then Technical Director at a UK DFIR firm. I've seen incidents from every angle. The constant was good people stretched too thin, doing important work with inadequate tools. We built Strand for them, and for the organisations counting on them.
Co-Founder
Chief Operating Officer
Years spent leading large teams to deliver AI-driven innovation into complex enterprises, turning ideas into commercial outcomes. I focus on building solutions that integrate seamlessly into operations: powerful enough to change performance, simple enough to deploy without friction.
Sales
Five years in B2B sales and business development across a wide range of markets. Now developing Strand's sales function into a globally scalable model.
Threat Research
Computer scientist with a background in intelligence, network security and systems exploitation. Tracks threat groups and their evolving techniques to keep Strand intelligence-driven.
Engineering
Engineering leader experienced in security platforms, AI-enabled products and scalable cloud infrastructure.
Strand complements these tools. It investigates the incidents and alerts they detect and runs forensic hunts for activity they may have missed.
Yes. Strand’s collectors can be deployed mid-incident, and the platform can also ingest existing KAPE and Velociraptor collections alongside EDR and SIEM telemetry.
Analysts retain judgement and the final conclusions. Strand automates evidence collection, investigation and report generation, with each finding linked to supporting evidence and a confidence level.
Strand processes data in the UK by default, with global data planes available. Deployment and data-residency requirements can be discussed with the team when arranging a demo.
Pricing is per investigation to suit incident-driven work. Contact the team to discuss your investigation requirements and obtain a quote.
Discuss your incident types, evidence sources and deployment requirements with the team.
