About Thunt
François Khourbiga
Founder & Lead Security Consultant
Senior cybersecurity consultant with over 20 years of expertise in incident response and digital forensics. I have led national-level and large-enterprise investigations for government agencies and Fortune 500 clients.
Former incident responder at ANSSI (French National Cybersecurity Agency) and Mandiant (now part of Google Cloud), I specialize in host-based forensics, malware reverse engineering, and threat hunting.
I also founded Defants, a Gartner-recognized automated incident response platform. My goal with Thunt is to return to what I love most: hands-on investigation and helping organizations solve complex security challenges.
Former Experience & Recognition
Our methodology
Every engagement follows a structured, hypothesis-driven approach for incident preparedness. We start with clear questions, collect evidence methodically, analyze with expertise, and deliver transparent findings with actionable recommendations. No black boxes, just proven investigative methodology adapted to your context.
Hypothesis Driven
We don't guess. We test.
Evidence Based
Facts over assumptions.
Actionable
Real results you can use.
Career & Recognition
A journey dedicated to defensive security.
Gartner Cool Vendor
Recognized for innovation in SOC automation.
i-Lab Winner
National innovation competition winner.
Founder & CEO
Deeptech startup specialized in semantic investigation using an automated incident response SaaS platform.
Incident Response Consultant
Frontline investigations for Fortune 500.
R&D Project Manager
Malware intelligence platform engineering.
Speaker
Talk on taint-based approach for return oriented programming.
Cyber Defense Engineer
Advanced threat hunting and reverse engineering.
Forensic Engineer
National incident response, crisis management and malware reverse engineering.
Our principles
Hypothesis-driven
Every hunt and investigation starts with a clear hypothesis. We test, validate, or refute — never fish blindly.
Evidence-based
Findings backed by artifacts, logs, and documented analysis. No assumptions presented as facts.
Transparent delivery
Regular status updates, clear scope boundaries, and reports that non-specialists can understand.
Independent expertise
Expert services under separate contracts by independent consultants. No vendor lock-in, no upsell.
Leverage our internal arsenal
Our clients benefit directly from our custom tooling and research. Enhanced detection, faster triage, deeper insights.
Start an investigation