EASM + Threat Intel
Discover → verify → prioritize
Understand exposure
EASM and threat intelligence reveal assets, credential leaks, lookalike domains and relevant vulnerabilities.
RUK-COM BLUE · CYBER DEFENCECyber defence built
Cyber defence built
around your business.
Ruk-Com Blue connects exposure discovery, protection and SOC response, with a service scope shaped around your critical systems and team.
YOUR CYBER DEFENCE
Internet / HTTPSUsers and incoming requests
↓ HTTPS
Firewall / WAFInspect against agreed policies
↓ Allowed requests
Your business systemsIdentity · Application · Endpoint
↓ Logs and alerts, separate from traffic
SIEM + SOCCorrelate evidence · analyst review
System illustration · response stays within approved authority
LAYERED DEFENCEThree connected layers.
Three connected layers.
One coordinated approach.
Choose protection layers around your systems, risks and team readiness.
Policy + Protection
Request → policy check → system
Protect & detect
Identity, firewall, WAF and EDR apply policies and send logs and alerts for investigation.
SOC + Response
Evidence → approval → verification
Respond & verify
SOC analysts use playbooks and SOAR within approved authority and verify outcomes.
EASM provides exposure context; it is not a traffic gateway or blocker. Tool connections depend on supported integrations and service scope.
THE THREAT
Threats take many forms
AI can accelerate parts of an attack. Identities, systems and data remain key targets.
Your business
Services · Systems · Data
Employee data exposure
Malware & ransomware
Leaked credentials
Phishing
Code & secret exposure
Application vulnerabilities
Botnets & attack traffic
2026 presentation figures and their limitations
1,000M+Attack requests per day
≈11,574Requests per second at a 1,000M/day baseline
10,000+WordPress sites with vulnerabilities found cumulatively
Figures are from the 2026 internal Ruk-Com Blue Team data used in the presentation. Requests are not attackers or successful breaches; AI usage is not separated. WordPress is a cumulative count that may include remediated sites; the source gives no cutoff date or deduplication method. These are not live metrics.
ENTRY POINTS
Assess exposure before choosing controls
Valid credentials
Leaked passwords, secrets or sessions may grant access within their permissions. Check MFA, account status and sessions together.
Known vulnerabilities
Check affected versions, configuration and access conditions. A CVE reference alone is not evidence of compromise.
Vulnerabilities without a patch
Reduce exposure while awaiting a patch with least privilege, segmentation and behavioral detection, considering the impact on operations.
INSIDE THE SYSTEM
Look beyond system availability
After gaining access, an intruder may act in several ways. Reach depends on permissions and connectivity.
- Persistence
A backdoor or web shell may survive patching. Inspect files, accounts and permissions as well.
- Lateral movement
Access can spread through permissions and connections. Segmentation helps limit reach.
- Collection
Files or screenshots can be collected from accessible systems while services keep running.
- Exfiltration
Confirm export results, application audit and network egress before concluding data left the system.
An explanatory scenario, not a fixed sequence or a customer incident.
BUSINESS IMPACTProtect more
Protect more
than IT systems
Services & revenue
Ransomware or containment shutdowns can interrupt sales and services and add recovery costs.
Data & privacy
Encryption and data leakage are different impacts. Data may be stolen before it is encrypted.
Trust & opportunity
Restoring systems does not erase business damage. Paying a ransom does not guarantee data recovery.
OUTSIDE-IN VISIBILITY
Understand your external exposure
Connect each finding to a system and an owner, then prioritize what needs investigation or remediation.
Data leaks
Monitor exposed credentials, data and code from authorized sources. Verify relevance without testing leaked logins.
Brand protection
Track lookalike domains, phishing sites and impersonation, then verify the evidence.
External attack surface
Discover internet-facing assets, shadow IT and CVEs that may affect your environment.
Threat intelligence
Add threat context and indicators to prioritize risk. Intelligence alone does not confirm compromise.
FROM SIGNAL TO ACTIONFrom findings
From findings
to verified remediation
- Discover
Gather relevant assets, domains and exposure signals.
- Prioritize
Confirm owners and business impact; use AI summaries where supported.
- Verify
Verify evidence and perform authorized VA or pentesting when needed.
- Respond
Assign owners, act within scope and recheck the result.
CONNECTED OPERATIONSConnect signals,
Connect signals,
people and response
Separate investigation data from actions that affect systems, with clear accountability.
Signal sources
IdentityFirewall / WAFEDRCloud / App
↓ Logs and alerts
SIEM
Collect logs and correlate context
SOC
Analysts verify evidence and impact
SOAR
Execute playbooks within approval limits
↓ Approved actions through connectors
BlockRevoke sessionIsolate endpointDevelopment ticket
↳ Verify the result → report to SOC → review and improve
AI helps summarize and correlate; people verify and decide. Alerts do not automatically change code or deploy it. Testing requires approved scope, timing and stop conditions.
Example: investigate a suspicious account before acting
- Connect signals
CASE-01 is fictional: relate user-demo, WS-01 and session S-01 by time. Endpoint evidence does not directly confirm the session.
- Check the unknowns
Check the account owner and change ticket. A DNS query is not a data leak; an export queued is not a completed transfer.
- Approve and act
The incident lead and system owner approve scope before supported session revocation or endpoint isolation.
- Verify and recover
A password reset is not session revocation or endpoint isolation. Verify each action and fix the cause before recovery.
CONTINUOUS SECURITYSecurity is a cycle,
Security is a cycle,
not a one-time task
- EASM + Threat Intelligence
Discover exposure, confirm ownership and prioritize.
- VA / Pentest / Red Team
Assess vulnerabilities, validate impact or exercise defences under approved objectives; remediate and retest.
- MDR + SOC
Monitor, investigate and respond; feed lessons back into discovery and prevention.
PEOPLE BEHIND THE RESPONSESOC in Ari.
SOC in Ari.
People behind the decisions.
- Connect
Connect logs, endpoint, cloud and identity sources within scope.
- Analyze
Analysts check relevance, evidence completeness and business impact.
- Respond + verify
Coordinate owners, act within authority and verify results before closure.
FROM PREVENTION TO RECOVERYBlue Team care.
Blue Team care.
Before, during and after.
- See
Know critical systems, owners and logging gaps. No alert is not proof of safety.
- Analyze
Compare alerts with identity, time and approved work; check false positives.
- Respond
Use tested playbooks with approvers, stop conditions and outcome checks.
- Recover
Separate backups, test restore and dependencies, compare with RTO/RPO and fix root causes.
Recovery must be tested; it is not guaranteed to be complete or immediate. SOAR does not itself decrypt ransomware.
GOVERNED SERVICEClear agreements.
Clear agreements.
Accountable operations.
Scope & ownership
Agree co-managed or fully managed delivery, scope, SLA, contacts and escalation channels.
Authority & change
Define approvers, permitted actions, emergency authority and feasible recovery or rollback.
Data & review
Agree purpose, access, PDPA data roles, coverage hours and service review cadence.
Start with a measurable pilot
- How many critical systems meet logging completeness and freshness criteria?
- Which playbooks pass tests, and which cases remain untested?
- Measure alert-queue-to-analyst-start time by severity and coverage hours.
- Compare actual restore and dependency results with agreed RTO/RPO.
Pricing, response times, integrations and authority are confirmed in the proposal and contract. This is not a package that automatically includes every tool.
LET’S TALKStart with the systems
Start with the systems
your business depends on.
Tell us about your systems, security concerns and current team so we can discuss an appropriate service scope and starting point.
View the original presentation · 14 scenes
A continuous presentation in Thai. Animated events are simulations, not live data.
Open presentation in a new tab ↗