Monitoring, Threat Detection, Mitigation, and Training

Booz Allen offers a variety of products and services to strengthen the security of your cyber operations, from detecting adversaries to creating mitigation strategies.

Adversary Pursuit – Operational and Tactical Intelligence Reporting 

Booz Allen's Adversary Pursuit applies nation-state level of expertise to cyber intelligence research. We discover new adversary malware, then create custom anti-malware analysis and mitigation solutions. Bringing government expertise from intelligence and law enforcement to bear for businesses, we combat some of the country’s most challenging cyber adversaries.    

Research that includes tracking adversarial tools; infrastructure; and tactics, techniques, and procedures (TTP) allows us to deliver operational and tactical intelligence and detection logic to proactively hunt for adversaries in client networks. 

Booz Allen Adversary Pursuit – Defensive Exploitation Tools

In addition to our reports and playbooks, we also offer sophisticated defensive exploitation tools that allow clients to gain new insights into adversary activity, and provide several unique adversary defeat options. Some example capabilities include:

• Scanners to detect the presence of adversary malware
• The ability to interact directly with malware by exploiting adversary developer mistakes or triggering built-in backdoors
• On-host and on-the-wire cryptographic solutions and decryption capabilities providing unique insights into adversary activity

Booz Allen’s Cyber Precog: A Next-Generation Flyaway Kit

To better enable incident response teams, particularly those tasked with threat hunting at the tactical edge, Booz Allen has partnered with NVIDIA to develop Cyber Precog. It's a highly customized, GPU-enabled platform that integrates operationally honed cyber tooling, mission-relevant AI models, and modular pipelines for rapid capability deployment. 

Built using the NVIDIA Morpheus framework, Precog offers an initial suite of core capabilities along with a flexible software fabric for developing, testing, and deploying new GPU-accelerated analytics during an incident response mission. By building all components around an open architecture, Precog gives agility back to the threat hunters while bringing the power of an enterprise cloud environment to the edge.

Learn more about Booz Allen's Cyber Precog 

CANvert™

Common to most modern cars, trucks, and SUVs, the Controller Area Network (CAN) bus serves as a kind of vehicle central nervous system. The many instances of exploits targeting the CAN bus highlight possible vulnerabilities in the core functionality of millions of vehicles which, if exploited, could have potentially catastrophic results.

Through the combined expertise of cyber research and development efforts, hardware design and refinement teams, and Booz Allen’s Vehicle Cyber Analytics Center, we have created a low-level, real-time vehicle intrusion detection and prevention system. Booz Allen's CANvert™ system specifically addresses the concerns of automotive security in everyday life. CANvert uses multiple configurable data logging and manipulation tasks alongside hardware interfaces to implement two methodologies of processing: active and passive. In doing so, CANvert provides real-time filtering for the target vehicle’s CAN bus with minimal performance impact. CANvert is United States patent pending.

Global4Sight™

Booz Allen’s Global4Sight™ analytic capability enables government and commercial organizations to foresee and preemptively respond to incidents and emerging trends. Using an innovative hybrid team of regional experts, research analysts, and data scientists, Global4Sight provides clients with a better understanding of their operating environment through digital and information landscape reports.

Our team has developed cutting-edge methods and technologies that combine advanced research tradecraft with big data analytics to generate new insights for our clients’ missions. With experience across government, private industry, and academia, our reports cover a range of topics and sources including:

1. Regional media environments
2. Disinformation and misinformation trends
3. Threat activity and tactics