Who Tracknosis is for

"Something happened. What did they change, and is it still there?"

For security analysts, incident responders and SOC teams.

An alert fires, but it doesn't say what the attacker changed. Logs may be incomplete or wiped, and every hour spent gathering data is an hour not spent containing the threat.

• Every file and registry change since the last scan, rated High, Medium or Low with a reason
• New auto-starts, services and scheduled tasks linked to the files they launch
• Faked timestamps, cleared event logs and switched-off auditing flagged
• Deleted attacker tools often recoverable, written to a different volume
• Findings sent to Splunk alongside your existing alerts

Guide: how to detect timestomping on Windows →

Free checklist: the first hour after an incident or outage →

"The regulator wants answers in 24 hours. Where's the evidence?"

For CISOs, compliance, risk and audit teams.

NIS2 expects an early warning within 24 hours and a notification within 72. CIRCIA is coming in the US. Without evidence, reports are built on estimates.

• A record of what changed, when, and how risky it was, kept scan by scan
• Each scan stamped with machine, volume, tool version, operator and time
• AI report drafts for NIS2 and CIRCIA built from the evidence, for your team to review
• Signs of tampering, such as cleared logs, reported as findings, not left as gaps
• History you can go back to for audits, months later

NIS2 & CIRCIA: how Tracknosis helps →  ·  Free report templates →

"Is every server still the way we built it?"

For teams running Citrix, VDI, Remote Desktop and large Windows server estates.

Shared servers and session hosts change constantly: updates, user software, configuration tweaks. Something unwanted can hide among thousands of routine changes.

• A lightweight agent with no kernel driver, suited to shared and session hosts
• See what changed on each host after an image update, patch or user session
• Routine profile and update noise hidden; risky changes never are
• New auto-starts and unsigned executables on shared hosts flagged
• Works on Windows wherever it's hosted: on-premises, private cloud or public cloud

"Our clients ask what happened. We need to prove it."

For managed service providers and managed security providers.

When a client has an incident, the provider is expected to explain it quickly and clearly, often across machines nobody was watching closely.

• Evidence-backed answers for client incidents, in plain language
• Findings sent into your Splunk alongside your other client data
• Report drafts that help your clients meet their NIS2 and CIRCIA duties
• A new forensic service to offer, without new infrastructure
• Partner and OEM options available

See partner options →