Hugo Frauches
ENPTLet’s talk

FIELD EXPERIENCE

Security work, in the field.

More than eleven years in cybersecurity, from a security integrator to CTO. Since 2019 I have led the security practice where I work: first the offensive team, then the 24/7 SOC and the Blue and Red Team operations, and today as CTO. This is the work behind that path, without client names.

PRACTICE AREAS

Six disciplines, one operation.

Offense, defense, response and governance were run as one practice, so lessons from one side reached the others.

01

Offensive security

Penetration tests and red team exercises, from one-off assessments to recurring programs with retests.

  • External and internal infrastructure, Active Directory, wireless and cloud
  • Web applications, APIs and mobile apps
  • Objective-based red teams combining intrusion, spear phishing, voice phishing and lateral movement
  • Industrial and operational networks in scope when the business required it

02

24/7 SOC and MDR

A shared, around-the-clock security operations center with dedicated people for each account.

  • SIEM/XDR, behavior analytics, automation and managed EDR
  • A tech lead and dedicated analysts per contract, plus an on-call line
  • Monthly reports with incidents by severity, false positives, MTTA and MTTR
  • Single environments of up to about 6,500 monitored assets

03

Vulnerability operations

Continuous vulnerability management across IT, web, industrial systems and the external attack surface.

  • Risk-based prioritization: severity, known exploitation, internet exposure and business criticality
  • Remediation plans agreed with the teams that own each asset
  • One consolidated risk view fed by many scanners and tools
  • Patch management and verification of every fix

04

Incident response and forensics

Emergency response from the first call to the final report, for technical and executive audiences.

  • Ransomware, server intrusions, payment fraud and business email compromise
  • Card skimming at checkout, data leaks and insider investigations
  • Containment, threat hunting, eradication and controlled recovery
  • Reports for executives, lawyers, police and the data protection authority

05

Threat intelligence and exposure

Seeing the organization the way an attacker sees it, before the attacker does.

  • Deep and dark web monitoring, leaked credentials and infostealer logs
  • External security ratings and attack-surface programs
  • Threat advisories for customers, about 70 between 2020 and 2025
  • Threat-actor intelligence during active incidents

06

Governance, privacy and architecture

The programs and controls that keep the results in place after the test or the incident.

  • Privacy programs under Brazil’s LGPD and DPO as a service
  • Security policies, business continuity plans and risk assessments
  • Rollouts of EDR, firewalls and WAF, DLP, MFA and privileged access
  • Owner of the security procedures in the company’s own ISO 27001 and 27701 system

My part in it

  1. From 2019 to 2022 I managed the offensive team: scoping engagements, planning and leading penetration tests, assessments and social engineering, and supporting pre-sales.
  2. As Head of Security, from 2022, I structured the Blue Team and Red Team operations behind long-term contracts and became the executive escalation point for customers.
  3. As CTO, since 2023, I run the security operation, lead incident responses and their executive communication, and bring what we learn in the field into the AI products.

SELECTED CASES

Eight engagements, anonymized.

Each case is described by sector and size only. Details that could identify an organization, an asset or a person were left out on purpose.

Vulnerability operations

Remediation at industrial scale

Context
A multinational industrial group with seven business units and findings spread across many owning teams. About three years of continuous service.
What we did
Continuous scanning of about 50,000 assets, around 16 penetration tests a year and a remediation process with 24 resolver groups.
Result
A steady remediation cadence: about 70 remediation plans and 135 follow-up meetings every quarter.

Vulnerability operations

One risk view for IT, OT and cloud

Context
An energy company with corporate, industrial and cloud environments, each with its own tools.
What we did
A global vulnerability operation center that connects about ten tools and ranks risk by severity, known exploitation, internet exposure and business criticality, with patch management as its own pillar.
Result
One prioritized view of risk across IT, OT and cloud.

Red team

Objective-based red team on critical infrastructure

Context
An operator of critical infrastructure that wanted to test people, process and technology together, including its operational network.
What we did
External intrusion, email and voice phishing, lateral movement, web and API testing, and the operational network in scope.
Result
One combined report across people, process and technology, with remediation priorities for leadership.

Incident response

Ransomware in a manufacturing plant

Context
A manufacturing plant stopped by ransomware.
What we did
Forensics across 43 servers and about 10 GB of logs, with support to leadership throughout the crisis.
Result
The customer stayed on for the long term: vulnerability management, insider-risk monitoring and managed detection and response.

Incident response

Kernel rootkit in academic systems

Context
A public education institution whose academic and administrative Linux servers were compromised at the kernel level.
What we did
Host-by-host containment, a mass threat-hunting and eradication campaign, firewall hardening with intrusion prevention and SSL inspection, and a clean-rebuild plan.
Result
A detailed final report structured according to NIST SP 800-61.

Incident response

Card skimming at an online checkout

Context
A consumer e-commerce operation whose payment page had been altered by attackers.
What we did
Forensics of the checkout, root-cause analysis and separate deliverables for executives, lawyers and police.
Result
A signed root-cause report supporting the notification to Brazil’s data protection authority.

SOC / MDR

Security operations for the public sector

Context
A city government, won through public tender, and judiciary bodies.
What we did
Managed SOC with vulnerability management, EDR, SIEM/XDR with network sensors, incident response and backup.
Result
Continuous monitoring of environments with up to about 6,500 assets.

AI security

Testing and investigating with AI in the loop

Context
A government generative-AI platform, and a consumer-goods company investigating a breach in its online store.
What we did
A gray-box penetration test of the AI platform, and an AI-assisted investigation of the store’s logs.
Result
A test scope that included the AI layer itself, and guidance on notifying the data protection authority after the breach.

INSIDE AN INVESTIGATION

Tracking a threat actor, step by step.

After an attack on public websites, I led the investigation of the group behind it, from the compromised servers to the structure behind its brand, and the report went to the police. These are the techniques, without the case: no group, people, companies, places or dates.

  1. 01

    Preserve before the adversary does

    • Copy the attacker’s public tooling and pages as soon as they are found. In this case they were deleted hours later.
    • Hash every artifact with SHA-256 and keep an evidence notebook with an integrity table.
    • Use public web archives as independent, third-party proof of what a page showed and when.

  2. 02

    Rebuild the attack from primary evidence

    • Server logs and file systems first, intelligence reports second. When they disagreed, primary evidence won.
    • A timeline and attack chain from reconnaissance to impact, including the step that failed: an attempt on a software supplier’s central repository that would have reached every customer.
    • Hunting patterns derived from the attacker’s files to sweep the whole customer base, which also surfaced an older compromise that had never been eradicated.

  3. 03

    Read the adversary’s mistakes

    • Code-history forensics: commit metadata, secrets added and removed minutes later, and build artifacts that revealed usernames, paths and language versions.
    • Scan output committed by accident proved the targets had been chosen months before the attack.
    • Static analysis of the group’s own tools, to compare the capabilities it advertised with what actually happened.

  4. 04

    Pivot carefully

    • Infrastructure pivots across addresses, hosting providers and domain registrations. A payment domain registered the day before the attack linked the intrusion to the money.
    • Historical indicators labeled as historical, so that a reassigned address does not get an innocent third party blocked.
    • Passive social-media intelligence: public metadata only, with no following, no viewing of ephemeral content and no interaction. Identical invite links and visual identity served as pivots, and stable usernames counted more than display names.
    • No entry into closed channels without legal cover.
    • Independent signals, such as language, regional markers and the scope of targets, converging on the group’s likely base and the right jurisdiction.

  5. 05

    Attribute with discipline, then hand off

    • Every claim graded as established fact, strong indication, inference or not established.
    • Technical attribution (tooling, brand, infrastructure) kept apart from social attribution (identities).
    • A digital identity is not a person: commercial data aggregators were treated as leads, not proof, and the presumption of innocence was stated in writing.
    • A prioritized list of legal requests for the authorities, starting with preservation orders because the actor was deleting infrastructure.
    • A dedicated edition for the police, with guidance to redact images of people.

The investigation turned a brand into a short list of well-defined legal requests, and it did not claim any authorship the evidence could not prove.

Sectors

  • Industry, steel and mining
  • Energy and utilities
  • Public sector and judiciary
  • Financial services and fintech
  • Health
  • Technology and software
  • Education
  • Logistics, ports and transport
  • Cooperatives
  • Retail and e-commerce
  • Construction and real estate

Reach

Most of the work was in Brazil. It also included engagements for organizations in Europe, North America and Latin America.

How I run security operations

  • Scope starts with the business question, not with the list of assets.
  • Every account has named owners, a responsibility matrix and a fixed weekly, monthly and quarterly rhythm.
  • Reports are versioned and reviewed before they reach the customer.
  • Metrics such as MTTA, MTTR and remediation progress go to leadership, not just to the technical team.

All engagements took place at Intelliway from 2019 onward, under my leadership. Clients, assets and companies are not identified, and figures are rounded down. Work the company delivered before I joined is not included.

See the AI products →