# For banks & financial institutions > Threat intelligence for banks: decoys of your own kit, lookalike and fake-app takedowns, customer scam reports, DORA and NIS2 evidence, on-prem or hosted. Source: https://wahukeza.com/solutions/banks Solutions · Banks & financial institutions ## Catch the fake login page before your customers find it. Wahukeza gives a bank the local layer a group SOC cannot see: decoys that look like your own systems, lookalike and fake-app hunting with takedowns you can measure, reports from staff and customers, and DORA and NIS2 evidence drafted from the case, running in your own data centre, with nothing calling home. [Book a scoping workshop](https://wahukeza.com/contact?intent=workshop) [See packages](https://wahukeza.com/pricing) Why banks ## Four pressures, at the same time. - ### Fraud lands on your customers first Lookalike domains, cloned login pages behind reverse-proxy (AiTM) kits, fake banking apps, scam channels and mule IBANs. The attack happens outside your network, against people who trust your name. - ### The regulatory load keeps growing DORA and NIS2, in Montenegro the Law on Information Security (Sl. list CG 113/2024), plus your central bank’s expectations: classify incidents, meet the clocks, report to the board, show the evidence. - ### A group SOC is already in place Many banks already feed a group SIEM. Wahukeza adds the local layer it cannot see (your own decoys, your brands, your exposure) and exports to Microsoft Sentinel, Splunk, Elastic or CEF/syslog so the group keeps one pane. - ### Small teams, long lists Unlimited analysts, so the whole team works in it without a seat count. Automation for the routine, with consequential steps waiting for approval, including from a phone. Problem by problem ## What each module does for a bank. Start with the problems you have today. Every module except the two AI modules can be licensed on its own. - Someone is already inside ### Deception Fabric Decoys that look like your own kit: FortiGate, Ivanti Connect Secure, SAP NetWeaver, a SQL Server that refuses every login. Internal decoy groups with planted credentials and their own DNS records, and canary tokens: any internal touch pages Critical, and with Endpoint Intelligence the host that made it is named. Tell us what your estate runs and the capture engine clones it as a decoy. [How it works](https://wahukeza.com/platform/sensors) - Customers are being impersonated ### Brand & fraud protection Lookalikes including Cyrillic homoglyphs and ccTLD swaps, a page canary that fires when your login page renders off your domain, fake apps on the Apple App Store and Aptoide, and takedowns the analyst sends and the platform measures: median and p90 time-to-takedown per provider. [How it works](https://wahukeza.com/platform/brand-protection) - Customers report scams to the call centre ### Customer report channel A public report-a-scam form and mailbox, QR codes decoded in the browser, no name or e-mail stored. Phone numbers, sender IDs and IBANs are confirmed only after three distinct reporters in 14 days. [How it works](https://wahukeza.com/platform/brand-protection) - Staff receive the phishing first ### Phishing Reporting One button in Outlook, a verdict with reasons shown in the pane, and confirmed links and senders straight into the blocklist. [How it works](https://wahukeza.com/platform/phishing) - Nobody has the full list of what faces the internet ### Attack Surface Management Domains, hosts, certificates and IPs discovered from seeds you prove you own, assessed against a closed catalogue of 20 exposure rules and ranked by how many sources are probing that exposure on your own sensors this week. [How it works](https://wahukeza.com/platform/attack-surface) - The supervisor asks for evidence ### Regulatory evidence & audit DORA and NIS2 incident classification with the triggering criteria named, the reporting clocks, notifications drafted from the case for the analyst to file, a management-body report in English and Montenegrin, and an auditor evidence pack with a controls map. [How it works](https://wahukeza.com/platform/regulatory) - Fraud moves between banks faster than e-mail ### Sector sharing groups Vetted groups with TLP:AMBER inside the group, attributed or anonymised contribution, a central bank as reader if you choose, and the DORA Art. 45 membership notice in English and Montenegrin. A payee-risk lookup answers whether an IBAN or phone number is known, never who reported it. [How it works](https://wahukeza.com/platform/exchange) - Laptops, servers and phones ### Endpoint & mobile Managed osquery for indicator matching and patch compliance, gated response verbs, and an Android work-profile agent that flags sideloaded apps and blocks known-bad domains, the place a fake banking app shows up. [How it works](https://wahukeza.com/platform/mobile) - E-banking goes slow under load ### Availability & DDoS detection Learned baselines from your own routers and hosts, an alarm with an all-clear that closes the same incident, and a SIEM stream. Detection only: the hand-off to your ISP or scrubbing provider stays in your runbook. [How it works](https://wahukeza.com/platform/availability) End to end ## One fake login page, from first sight to the board report. Every step that touches the outside world (a takedown request, a customer warning) is an analyst’s decision. The platform prepares it, sends it on a click and measures it. 1. 01 ### Spotted A new certificate for a lookalike of your e-banking host (a .co.me swap or a Cyrillic homoglyph) appears in certificate transparency. Or the page canary fires because your own login page just rendered on someone else’s domain. 2. 02 ### Confirmed The platform screenshots the page, finds the credential form, matches it to your login and links copies by kit fingerprint. The analyst confirms; nothing closes on its own. 3. 03 ### Blocked The domain goes to your firewall and DNS blocklists, to the per-brand confirmed feed, to staff phones through Private DNS, and to the group SIEM. 4. 04 ### Taken down One click sends a hashed evidence pack to the registrar or host; reports to Netcraft, Google Safe Browsing and Microsoft SmartScreen are prepared alongside. If nothing moves, the escalation to the .me registry and the national CERT is already drafted. 5. 05 ### Told and recorded The public fraud-alerts page warns customers in Montenegrin and English. The case keeps the timeline, the classification if it becomes an incident, and the time-to-takedown that goes into the board report. Your own estate, as a decoy ## Tell us what you run. We capture it as a decoy. The capture engine turns a real device or web application (an appliance’s management interface, an e-banking-style login) into a decoy with one command and three inputs: host, user and password. It records what an attacker would explore, anonymises it behind a human review, and packages it as a container image. Configuration changes get a plausible “saved” and change nothing. [How the capture engine works](https://wahukeza.com/platform/sensors#capture) 1. Inputhost:port · user · password 2. Capturecrawl every menu, record every response; destructive actions skipped 3. Reviewanonymisation gate, then a human 4. Packagecontainer images for amd64, arm64 and armv7 5. Deployoutside in the DMZ, or inside as an internal decoy It replicates the surface an attacker reads and navigates. Bespoke encrypted logins need work per device. Built for the region ## Local where it matters. - .me · .co.me · Cyrillic ### Lookalikes as they are registered here ccTLD swaps across .me, .rs, .ba, .hr, .si, .mk, .al and .eu with a mirrored Public Suffix List, Latin diacritics (č ć š ž đ), Cyrillic and Greek homoglyphs, and Cyrillic IDN domains. - Montenegrin ### Reports in the board’s language The management-body report and the public fraud-alerts page are produced in Montenegrin and English. The application itself is in English. - Sl. list CG 113/2024 ### The national law, by name Montenegro’s Law on Information Security is handled as NIS2, with the Agency for Cyber Security as the authority. The platform classifies and drafts; your team files. - controls map ### Room for your supervisor’s clauses The evidence pack maps to DORA, NIS2 Art. 21(2) and ISO/IEC 27001:2022 Annex A, and takes your own references, central-bank clauses included. A mapping, not a certification. Beside the group SOC ## The local layer, exported to the SIEM you already have. Wahukeza does not ask the group to change its pane of glass. Detections, alerts, decoy sessions, indicator changes, the audit log and availability incidents stream to the group SIEM; blocklists go to your own firewalls and resolvers; tickets go to Jira or ServiceNow. - SIEMMicrosoft Sentinel · Splunk · Elastic · CEF/syslog-TLS · JSON webhook - Streamsdetections · alerts · honeypot sessions · indicator changes · audit · availability - BlocklistsPalo Alto EDL · Fortinet · Suricata · DNS RPZ · nginx · plain · JSON - TicketsJira Cloud · ServiceNow - ChannelsPagerDuty · Opsgenie · Teams · Slack · e-mail Delivery and sovereignty ## In your data centre, or as a tenant we operate. Choose the model per installation, combine them, and change your mind later; data exports in STIX 2.1, CSV and JSON. - On-prem in the bank Docker Compose on a VM, or Kubernetes with Helm for high availability. Your hardware, your database, your jurisdiction. - A licence file, no call-home The licence is a signed file verified offline. If it expires the platform falls back to the Community edition; it never goes offline. - AI on your terms A local model, Anthropic with your own key, or off. With AI off, everything except AI summaries and classification still works. - Public data, switchable The platform fetches public data (NVD, vendor advisories, the Public Suffix List, app-store search) and every external fetch can be switched off. - Or a hosted tenant Its own database on a Wahukeza-operated instance, with Trony Network as processor under the DPA. - Unlimited analysts An annual licence per installation or tenant. The whole security team, the fraud team and the auditor can have accounts. Where banks usually start ## Standard protects customers and staff. Standard adds Brand Protection and Phishing Reporting to the core and the decoys. Advanced adds Attack Surface Management, Automated Playbooks, SSO and SCIM, and AI analysis. Availability & DDoS detection sits outside the packages and is licensed separately. - Basic Core + 2 external and 3 internal decoys - Standard \+ Brand Protection, Phishing Reporting; 5 + 5 decoys - Advanced \+ Attack Surface, Playbooks, Enterprise Identity, AI Threat Analysis - Complete \+ endpoint and mobile modules, Advanced AI, emulation The scoping workshop ## Two hours, on-site or online. You leave with a package or module mix; the written quote and the implementation plan follow. - Your estate: what faces the internet, and which systems an attacker would look for inside - Sensor locations: the DMZ or behind NAT, and internal segments - Brands, domains, apps and channels customers know you by - Integrations: firewall and DNS, the group SIEM, Microsoft 365, the identity provider - Reporting: who receives the board report, and in which language - Delivery model: on-prem, a hosted tenant, or both ## Start with a scoping workshop. Two hours with an engineer, at your premises or online. Bring the people who own the firewall, the SIEM and the fraud desk. [Book a scoping workshop](https://wahukeza.com/contact?intent=workshop) [Request a quote](https://wahukeza.com/contact?intent=quote)