Cybersecurity
Threat intelligence
Intelligence is useful when it changes a decision. We help you work out which threats are relevant, translate their behavior into detections and tests, and avoid drowning in indicators that expire in a day.
The problem this service solves
A feed full of IP addresses and hashes is easy to buy and hard to use. The addresses change before they are blocked, and nobody checks whether the threats described ever target organizations like yours.
Behavior lasts longer than indicators. Techniques documented in public reporting can become detections and test cases, and the same threat profile guides which risks get engineering attention first.
What is in scope
-
Threat profile
Which actor types and techniques are relevant to your industry, geography and technology.
-
Technique mapping
Translate reporting into ATT&CK techniques and check your coverage.
-
Detection and test priorities
Feed priorities to detection engineering and to penetration test or purple team planning.
-
Feed review
Evaluate current sources for relevance, cost and how they are consumed.
-
Intelligence process
Requirements, collection, analysis and dissemination, sized for your team.
-
Reporting
Short, regular briefs for leadership and operations.
How the work runs
Define
Set requirements.
-
1
Priority intelligence requirements
What decisions should intelligence support?
Analyze
Build the profile.
-
2
Source review and analysis
Gather relevant reporting and extract behaviors.
-
3
Coverage mapping
Compare techniques with your detections and controls.
Apply
Change something.
-
4
Action list
Recommended detections, tests and control improvements.
-
5
Cadence
A light recurring brief and review.
What you receive
- Threat profile
- ATT&CK coverage comparison
- Prioritized detection and testing recommendations
- Feed evaluation
- Briefing template
Tooling and technique
Sources are examples. We do not sell or resell threat intelligence feeds.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- A description of your business and critical assets
- Existing feeds and subscriptions
- Detection and testing teams to receive recommendations
What this service is not
- A dark-web monitoring service
- Real-time alerting on external threats
What changes afterwards
- Intelligence reaches detection and testing decisions
- Indicator volume falls while relevance rises
Questions people ask
Do you provide a threat intelligence feed?
No. We help you use public sources and feeds you already have.
Is intelligence only for large organizations?
No. A small team can do useful work by reading government advisories and sector reporting with a defined purpose.
Related
-
Detection engineering
Design, write, test and maintain detections tied to specific attacker behaviors, with false-positive control and documented response steps.
-
Red teaming
Objective-based adversary simulation that tests people, process and technology together against a realistic attacker over several weeks.
-
Vulnerability intelligence lookup
Look up a CVE and see its CVSS severity, whether CISA lists it as exploited and its EPSS exploitation estimate, side by side.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response