Solutions · Banks & financial institutions
Catch the fake login page before your customers find it.
Wahukeza gives a bank the local layer a group SOC cannot see: decoys that look like your own systems, lookalike and fake-app hunting with takedowns you can measure, reports from staff and customers, and DORA and NIS2 evidence drafted from the case, running in your own data centre, with nothing calling home.
Why banks
Four pressures, at the same time.
Fraud lands on your customers first
Lookalike domains, cloned login pages behind reverse-proxy (AiTM) kits, fake banking apps, scam channels and mule IBANs. The attack happens outside your network, against people who trust your name.
The regulatory load keeps growing
DORA and NIS2, in Montenegro the Law on Information Security (Sl. list CG 113/2024), plus your central bank’s expectations: classify incidents, meet the clocks, report to the board, show the evidence.
A group SOC is already in place
Many banks already feed a group SIEM. Wahukeza adds the local layer it cannot see (your own decoys, your brands, your exposure) and exports to Microsoft Sentinel, Splunk, Elastic or CEF/syslog so the group keeps one pane.
Small teams, long lists
Unlimited analysts, so the whole team works in it without a seat count. Automation for the routine, with consequential steps waiting for approval, including from a phone.
Problem by problem
What each module does for a bank.
Start with the problems you have today. Every module except the two AI modules can be licensed on its own.
Someone is already inside
Deception Fabric
Decoys that look like your own kit: FortiGate, Ivanti Connect Secure, SAP NetWeaver, a SQL Server that refuses every login. Internal decoy groups with planted credentials and their own DNS records, and canary tokens: any internal touch pages Critical, and with Endpoint Intelligence the host that made it is named. Tell us what your estate runs and the capture engine clones it as a decoy.
How it worksCustomers are being impersonated
Brand & fraud protection
Lookalikes including Cyrillic homoglyphs and ccTLD swaps, a page canary that fires when your login page renders off your domain, fake apps on the Apple App Store and Aptoide, and takedowns the analyst sends and the platform measures: median and p90 time-to-takedown per provider.
How it worksCustomers report scams to the call centre
Customer report channel
A public report-a-scam form and mailbox, QR codes decoded in the browser, no name or e-mail stored. Phone numbers, sender IDs and IBANs are confirmed only after three distinct reporters in 14 days.
How it worksStaff receive the phishing first
Phishing Reporting
One button in Outlook, a verdict with reasons shown in the pane, and confirmed links and senders straight into the blocklist.
How it worksNobody has the full list of what faces the internet
Attack Surface Management
Domains, hosts, certificates and IPs discovered from seeds you prove you own, assessed against a closed catalogue of 20 exposure rules and ranked by how many sources are probing that exposure on your own sensors this week.
How it worksThe supervisor asks for evidence
Regulatory evidence & audit
DORA and NIS2 incident classification with the triggering criteria named, the reporting clocks, notifications drafted from the case for the analyst to file, a management-body report in English and Montenegrin, and an auditor evidence pack with a controls map.
How it worksFraud moves between banks faster than e-mail
Sector sharing groups
Vetted groups with TLP:AMBER inside the group, attributed or anonymised contribution, a central bank as reader if you choose, and the DORA Art. 45 membership notice in English and Montenegrin. A payee-risk lookup answers whether an IBAN or phone number is known, never who reported it.
How it worksLaptops, servers and phones
Endpoint & mobile
Managed osquery for indicator matching and patch compliance, gated response verbs, and an Android work-profile agent that flags sideloaded apps and blocks known-bad domains, the place a fake banking app shows up.
How it worksE-banking goes slow under load
Availability & DDoS detection
Learned baselines from your own routers and hosts, an alarm with an all-clear that closes the same incident, and a SIEM stream. Detection only: the hand-off to your ISP or scrubbing provider stays in your runbook.
How it works
End to end
One fake login page, from first sight to the board report.
Every step that touches the outside world (a takedown request, a customer warning) is an analyst’s decision. The platform prepares it, sends it on a click and measures it.
01
Spotted
A new certificate for a lookalike of your e-banking host (a .co.me swap or a Cyrillic homoglyph) appears in certificate transparency. Or the page canary fires because your own login page just rendered on someone else’s domain.
02
Confirmed
The platform screenshots the page, finds the credential form, matches it to your login and links copies by kit fingerprint. The analyst confirms; nothing closes on its own.
03
Blocked
The domain goes to your firewall and DNS blocklists, to the per-brand confirmed feed, to staff phones through Private DNS, and to the group SIEM.
04
Taken down
One click sends a hashed evidence pack to the registrar or host; reports to Netcraft, Google Safe Browsing and Microsoft SmartScreen are prepared alongside. If nothing moves, the escalation to the .me registry and the national CERT is already drafted.
05
Told and recorded
The public fraud-alerts page warns customers in Montenegrin and English. The case keeps the timeline, the classification if it becomes an incident, and the time-to-takedown that goes into the board report.
Your own estate, as a decoy
Tell us what you run. We capture it as a decoy.
The capture engine turns a real device or web application (an appliance’s management interface, an e-banking-style login) into a decoy with one command and three inputs: host, user and password. It records what an attacker would explore, anonymises it behind a human review, and packages it as a container image. Configuration changes get a plausible “saved” and change nothing.
- Inputhost:port · user · password
- Capturecrawl every menu, record every response; destructive actions skipped
- Reviewanonymisation gate, then a human
- Packagecontainer images for amd64, arm64 and armv7
- Deployoutside in the DMZ, or inside as an internal decoy
Built for the region
Local where it matters.
.me · .co.me · Cyrillic
Lookalikes as they are registered here
ccTLD swaps across .me, .rs, .ba, .hr, .si, .mk, .al and .eu with a mirrored Public Suffix List, Latin diacritics (č ć š ž đ), Cyrillic and Greek homoglyphs, and Cyrillic IDN domains.
Montenegrin
Reports in the board’s language
The management-body report and the public fraud-alerts page are produced in Montenegrin and English. The application itself is in English.
Sl. list CG 113/2024
The national law, by name
Montenegro’s Law on Information Security is handled as NIS2, with the Agency for Cyber Security as the authority. The platform classifies and drafts; your team files.
controls map
Room for your supervisor’s clauses
The evidence pack maps to DORA, NIS2 Art. 21(2) and ISO/IEC 27001:2022 Annex A, and takes your own references, central-bank clauses included. A mapping, not a certification.
Beside the group SOC
The local layer, exported to the SIEM you already have.
Wahukeza does not ask the group to change its pane of glass. Detections, alerts, decoy sessions, indicator changes, the audit log and availability incidents stream to the group SIEM; blocklists go to your own firewalls and resolvers; tickets go to Jira or ServiceNow.
- SIEMMicrosoft Sentinel · Splunk · Elastic · CEF/syslog-TLS · JSON webhook
- Streamsdetections · alerts · honeypot sessions · indicator changes · audit · availability
- BlocklistsPalo Alto EDL · Fortinet · Suricata · DNS RPZ · nginx · plain · JSON
- TicketsJira Cloud · ServiceNow
- ChannelsPagerDuty · Opsgenie · Teams · Slack · e-mail
Delivery and sovereignty
In your data centre, or as a tenant we operate.
Choose the model per installation, combine them, and change your mind later; data exports in STIX 2.1, CSV and JSON.
On-prem in the bank
Docker Compose on a VM, or Kubernetes with Helm for high availability. Your hardware, your database, your jurisdiction.
A licence file, no call-home
The licence is a signed file verified offline. If it expires the platform falls back to the Community edition; it never goes offline.
AI on your terms
A local model, Anthropic with your own key, or off. With AI off, everything except AI summaries and classification still works.
Public data, switchable
The platform fetches public data (NVD, vendor advisories, the Public Suffix List, app-store search) and every external fetch can be switched off.
Or a hosted tenant
Its own database on a Wahukeza-operated instance, with Trony Network as processor under the DPA.
Unlimited analysts
An annual licence per installation or tenant. The whole security team, the fraud team and the auditor can have accounts.
Where banks usually start
Standard protects customers and staff.
Standard adds Brand Protection and Phishing Reporting to the core and the decoys. Advanced adds Attack Surface Management, Automated Playbooks, SSO and SCIM, and AI analysis. Availability & DDoS detection sits outside the packages and is licensed separately.
Basic
Core + 2 external and 3 internal decoys
Standard
+ Brand Protection, Phishing Reporting; 5 + 5 decoys
Advanced
+ Attack Surface, Playbooks, Enterprise Identity, AI Threat Analysis
Complete
+ endpoint and mobile modules, Advanced AI, emulation
The scoping workshop
Two hours, on-site or online.
You leave with a package or module mix; the written quote and the implementation plan follow.
- Your estate: what faces the internet, and which systems an attacker would look for inside
- Sensor locations: the DMZ or behind NAT, and internal segments
- Brands, domains, apps and channels customers know you by
- Integrations: firewall and DNS, the group SIEM, Microsoft 365, the identity provider
- Reporting: who receives the board report, and in which language
- Delivery model: on-prem, a hosted tenant, or both
Start with a scoping workshop.
Two hours with an engineer, at your premises or online. Bring the people who own the firewall, the SIEM and the fraud desk.