Kage Security Lab helps organisations see what an attacker can see: exposed systems, weak identity controls and leaked credentials. We monitor the sources adversaries use, test your defences against current techniques, and help you close the gaps that matter most.
FIG. 01 — Free tools
The same reconnaissance attackers run against you, packaged as free checks. Every tool runs in your browser.
FIG. 02 — Depth
Three layers of exposure. We cover all of them.
00 — External surface
We map your internet-facing footprint the way reconnaissance tooling does: domains, subdomains, certificates, exposed services, look-alike domains, fake apps and leaked documents.
01 — Identity & cloud
Identity is the new perimeter. We assess Microsoft Entra ID, Microsoft 365, Conditional Access and SaaS tenants for the misconfigurations that turn one phished user into a tenant-wide incident.
02 — Criminal underground
Analysts track forums, marketplaces, stealer-log channels and ransomware leak sites for your domains, executives and suppliers, then work the finding through to remediation or takedown.
FIG. 03 — Services
Most providers either watch or test. We do both, and each side informs the other.
Threat Intelligence
Threat Intelligence & Dark Web Monitoring
Continuous monitoring of forums, marketplaces, stealer-log channels and ransomware leak sites for your domains, people and suppliers.
Learn more
Threat Intelligence
Brand & Domain Protection
Detection and takedown of look-alike domains, fake social profiles, rogue mobile apps and phishing pages that impersonate your brand.
Learn more
Security Operations
Vulnerability Assessment & Penetration Testing
Manual, standards-aligned testing of web applications, APIs, external and internal networks, cloud and mobile apps.
Learn more
Security Operations
Red Team Operations
Objective-based adversary emulation built from the threat actors and TTPs actively targeting your sector.
Learn more
Security Operations
Incident Response & Compromise Assessment
Rapid investigation of suspected compromise across endpoints, identity and Microsoft 365, with containment guidance from first call.
Learn more
Microsoft Security
Microsoft 365 & Entra ID Security Assessment
A deep review of your Microsoft cloud tenant (identity, Conditional Access, privileged roles, OAuth apps, Exchange and SharePoint) and how it works with the rest of your security stack, Microsoft or not.
Learn more
Microsoft Security
Entra ID & Conditional Access Hardening
Design and roll out Conditional Access, phishing-resistant MFA and privileged access controls that stop account takeover without locking users out.
Learn more
Microsoft Security
Microsoft Defender XDR Deployment & Tuning
Get full value from the Defender licences you already own: onboarding, attack surface reduction, automated response and alert tuning across endpoint, identity, email and cloud apps.
Learn more
Microsoft Security
Microsoft Sentinel & Managed Detection
Deploy Microsoft Sentinel with the right data, detections and automation, or let our analysts watch it for you around the clock.
Learn more
Every finding is human-verified and arrives with context, impact and a recommended action.
Red team scope is built from the actors and TTPs actually targeting your sector this quarter.
Purpose-built tooling for Entra ID and Microsoft 365 assessments, maintained in-house.
We do not stop at the report. Findings are tracked through remediation, takedown or confirmed removal.
FIG. 04 — Platform
Our in-house Microsoft 365 and Entra assessment platform. Clients get continuous posture scans, Conditional Access analysis, Zero Trust scoring and guided remediation, all under their own tenant consent.
FIG. 05 — Risk
Regulators expect you to know what is exposed. We assess against the frameworks your auditors use.
Assessments aligned to
| Jurisdiction | Law | Maximum penalty |
|---|---|---|
| European Union | GDPR | Up to €20M or 4% of global annual turnover |
| California, US | CCPA / CPRA | Per-violation fines; higher for intentional violations |
| United Kingdom | UK GDPR | Up to £17.5M or 4% of global annual turnover |
| Singapore | PDPA | Up to 10% of local turnover or S$1M |
| China | PIPL | Up to ¥50M or 5% of prior-year turnover |
| India | DPDP Act | Up to ₹250 crore per instance |
Summary only, not legal advice. Penalty ceilings vary by violation type and change over time.
FIG. 06 — Threat Intel
Node2Shell (CVE-2026-111497): the Brotli flaw reaching Node.js, Python and beyond
An out-of-bounds write in Google's Brotli decoder lets a single compressed HTTP request crash or potentially take over Node.js apps that accept Brotli bodies, including Express 5 by default. CISA lists it as exploited. What to patch, what else ships Brotli, and how to check.
PHP2Shell (CVE-2026-109618, CVE-2026-109619): patch PHP now
Two memory-safety bugs in the PHP engine allow unauthenticated remote code execution through ordinary web requests. Exploitation started within hours of disclosure and CISA has added both to KEV. What is affected, what to patch and how to hunt.
Defending Microsoft 365 against adversary-in-the-middle phishing
AiTM kits proxy the real Microsoft sign-in page and steal the session cookie after MFA completes. Here is what actually stops them.
Book a scoping call. We will show you what is visible about your organisation today and what to fix first.
