Triminus

Approach

Before you hand over anything: how Triminus works, how evidence is handled, and what it does not do.

The method

  1. Observe

    Establish what the available sources show, and what they cannot show.

  2. Investigate

    Reconstruct what happened. Classify it. Turn it into actionable findings.

  3. Act

    Contain, escalate or report, within the authority agreed in writing.

The cycle closes. A new detection rule or the lessons from an incident feed the next round of Observe. In an ongoing client relationship, the findings of one investigation are fed into the next.

In each practice:

  • Investigations: evidence identified and preserved → facts established → a report counsel can act on.
  • Security Operations: telemetry from the agreed sources → alerts triaged during service hours → containment within your pre-authorised actions, or escalation.
  • NightOps APAC: the partner’s queue watched during the contracted shifts → triage under the partner’s runbooks → action under the signed action matrix.

Evidence handling

Evidence is handled according to your requirements.

  • Evidence is hashed on acquisition, by default with SHA-256.
  • Physical media are connected read-only, through a write blocker.
  • In cloud environments, collection is documented with the platform’s own audit logs, where available. What can be collected and hashed depends on the platform and the access granted.
  • Evidence is stored encrypted, in Switzerland. Ask about encryption key handling.
  • Evidence is deleted six months after the matter closes, unless agreed otherwise. On request, you get a deletion confirmation.

In security operations, alert data and case notes stay in your environment, or in the SIEM Triminus runs for you in Switzerland. Other arrangements are possible.

Access to your environment

  • You provision the accounts and access, in your own platform, to fit your set-up.
  • Triminus works with the access you grant, nothing more.
  • Access stays under your control: you grant it, you withdraw it.

Standards and quality

  • Detections and findings use MITRE ATT&CK as the common reference framework.
  • Procedures draw on the relevant NIST guidance, such as SP 800-61 for incident response and SP 800-82 for operational technology (OT).
  • Your processes and playbooks apply by default.
  • As an additional service, an independent peer review is available on request.

Swiss data residency

Evidence and case data held by Triminus stay in Switzerland for their whole lifecycle, from acquisition to analysis and storage. No US cloud services are used for them in Triminus’s own systems; where the work happens inside your own tenant, your platform choice applies. Ask for the details and how they match your data protection needs.

How Triminus handles AI

Your data stays out of external AI.

  • Evidence, samples, logs and case files are never entered into an AI service outside Triminus’s control, and never used to train a model.
  • Where Triminus uses AI on your matter, for example to sort alerts, it runs on systems Triminus controls, in Switzerland, and the data does not leave them.
  • In your own environment, Triminus uses your platforms’ AI features only as you have set them up and approved them.
  • A person checks every finding and signs every report.
  • For work that involves no client data, such as Triminus’s own administration, Triminus also uses external AI services.
  • Tools in use named on request.

Independence

  • Every engagement starts with a conflict check. It rules out overlap between Investigations and Security Operations mandates and covers prior employment and contract terms, such as non-compete clauses. Where a peer review is requested, the reviewer goes through the same check.
  • No mandates involving the founder’s former employer.
  • Vendor independence: no resale, no referral fees and no affiliate arrangements. Good, established open-source tools are preferred where they meet your requirements.

What Triminus does not do

  • No legal advice.
  • No offensive services against third parties.
  • No access to systems the client does not control.
  • No IT operations. Response actions only as pre-agreed in the runbooks: containment, detection tuning and reporting.
  • No recovery guarantees.
  • No negotiation with attackers, including in ransomware cases.
  • No coverage at all hours: with new clients, service hours are agreed and limited.