01 ·
Valid accounts
T1078 — credentials stolen via helpdesk vishing, MFA bypass through push-bombing. No malware, no signature: just one extra operator with the right credentials.
Detection and response in minutes, not weeks.
Intel-driven MDR with European SOC 24·7·365. The TTPs of 180+ adversaries targeting European markets become detections before they reach you. Median containment ~11 min from confirmed alert.
Compliance
ISO/IEC 27001
NIS2 ready
DORA aligned
GDPR · ENISA
European SOC
24·7·365
L2 / L3 in Europe
Decision authority
EU data residency
Activation · 3 weeks from NDA to defensive presence
How we activate the MDR defense outpost.
No endless projects, no six-month discovery. Five verified steps reduced to the minimum viable for your stack · 3 weeks from NDA to full defensive presence. Security monitoring is already active from Week 1 during onboarding · the first real alert is contained in ~11 min, with detection mapped to MITRE ATT&CK against the TTPs of 180+ profiled adversaries. By Week 3: Fortgale Console provisioning, L2/L3 analyst federation on your platforms, European SOC operational H24. From that moment on, monthly threat briefings, quarterly tabletop exercises, and runbooks kept alive against your posture. Protection is not a go-live event · it's a property that grows from day 1 of integration.
- Day 001Discovery
First meeting · NDA · stack & probable adversaries mapping
- Weeks 1-202Onboarding
Telemetry connectors · monitoring already active
Monitoring live - Week 303Provisioning
Fortgale Console tenant · CISO/IT access
- Week 304Federation
Fortgale analysts on customer platforms
- Week 305Full protection
SOC 24·7 · ~11 min containment · European defense outpost
The problem · why intel-driven MDR is required
Signatures aren't enough — and never were.
Across European high-tier incidents in Q1 2026, valid accounts (T1078) and phishing (T1566) drive most initial access — before any malware-based detection fires. Source: ENISA Threat Landscape · MITRE ATT&CK telemetry.
02 ·
Zero-day
T1190 — exploits of file transfer, VPN, identity broker. Actors like Cl0p acquire 0-days on criminal markets and use them in targeted campaigns before CVEs are issued.
03 ·
Multi-domain
Endpoint, identity, cloud, network — lateral movement shifts the target before a single-telemetry SIEM can correlate. You need multi-domain AI correlation, not silo alerts.
How it works · service architecture
Four building blocks, one single cycle.
From the first alert to containment, all under a single point of contact. No vendor handovers, no translation, no grey zone.
01 ·
Multi-domain ingestion
EDR · NDR · IDR · CDR — telemetry from endpoint, network, identity and cloud, normalised into a single data fabric. Vendor-agnostic: we adapt to the stack you already have.
02 ·
Tier-zero AI-native
Multi-domain AI correlation against the TTPs of 180+ adversaries profiled by our CTI. 94% noise reduction. Only what merits the human analyst leaves tier-zero.
03 ·
Our L2/L3 analysts
European SOC, analysts with decision authority. Triage, investigation, attribution to the threat actor. Embedded in your regulatory environment — time zone, language and compliance context included.
04 ·
Response & containment
Median containment ~11 min from confirmed alert. Assisted remote response: process kill, credential reset, network segmentation on demand.
Proof · service metrics
Four numbers that anchor the MDR.
Metrics measured on real customer telemetry in Q1 2026. Updated quarterly.
~11 min
Median containment
from confirmed alert
from confirmed alert
94 %
Noise reduced
by tier-zero AI
by tier-zero AI
14
MITRE ATT&CK
tactics covered
tactics covered
180+
Adversaries profiled
and blocked
and blocked
For whom · two angles
Same MDR, two angles.
The CISO decides on risk. The IT lead decides on the runbook. Fortgale MDR produces evidence for both.
For the CISO
A named runbook per actor, ready before the alert.
Ransomware is not a question of "if" but of "when". Each month the CISO receives the profile of the 3 most probable adversaries against their sector, with the Fortgale runbook already mapped to each one.
- Monthly threat briefingActors, observed TTPs, campaigns active in your sector.
- Runbook per actorLiving playbooks mapped on MITRE, updated against the adversary.
- Board-ready reportingRisk · impact · decision. No technology slides.
For the IT lead
Zero translator handover. European analysts, immediate decision.
When the alert is real, decision time is containment time. Our L2/L3 analysts know your stack, share your time zone and regulatory context, and have decision authority.
- Median containment ~11 minFrom confirmed alert to remediation in production.
- Assisted remote responseProcess kill, credential reset, network segmentation on demand.
- Integration with existing stackVendor-agnostic · we adapt to the stack you already run in production.
Research · the foundation of MDR runbooks
Our MDR runbooks come from first-hand research.
When an MDR alert is confirmed, the runbook we execute has already been tested against the real adversary. We profile actors, analyse samples, track TTPs: this research becomes operational action in production — not shelfware.
Phishing Kits Bypass MFA and Hijack companies's accounts in minutes
Intelligence · Phishing Kit · Q1 2026 April 24, 2026Fortgale CTI14 min readRPT-26-0424 Observation of the quarter The 2026 phishing ecosystem has outpaced tradition…
Read article →
Investment-Targeted Phishing: How Phishing Kit Fuels Espionage in Funding Rounds
In the high-stakes world of venture capital and corporate funding, where millions hang in the balance and sensitive financial data flows freely, a new breed of cyber threat is em…
Read article →
Operation Storming Tide: A massive multi-stage intrusion campaign
In February 2026, the Fortgale Incident Response team investigated a multi-stage intrusion attributed to Mora_001, a Russian-origin threat actor exploiting Fortinet vulnerabiliti…
Read article →
Behind the Wheel: Unveiling the Supercar Phishing Kit Targeting Microsoft 365
UPDATES: 27.11.2024: As mentioned by TrustWave, "Supercar Phishing Kit" has an high level of overlapping with the most recent update of "Rockstar 2FA Phishing-as-a-Service" 26.09…
Read article →
Espionage activities targeting European businesses
In the evolving landscape of cybersecurity threats, Fortgale is tracking PhishSurf Nebula, an advanced Cyber Espionage group active since 2021 and primarily targeting entities wi…
Read article →
Nebula Broker: offensive operations made in Italy
Fortgale has been tracking an Italian Threat Actor, internally dubbed as Nebula Broker, since March 2022. The actor uses self-made malware (BrokerLoader) to compromise Italian sy…
Read article →
Speak with the defense outpost
One meeting. One NDA. A real runbook on your stack.
We bring the Report on your sector with the most probable adversaries and a real MDR runbook mapped to your technology stack.