Credential / API Token: Data Point Intelligence Guide
An exposed credential is not a curiosity to explore. It is an incident with a clock running, and the only...
Breach Intelligence
Password / Credential: Data Point Intelligence Guide
An exposed credential is a defensive workload, not an offensive opportunity. The only question worth asking is which of your...
Data Breach: Data Point Intelligence Guide
A breach is not a single event, it is a dataset with a life of its own. The incident ends...
Device / Advertising ID: Data Point Intelligence Guide
An advertising identifier was designed to be a resettable, privacy-preserving marketing token. In practice it became one of the most...
Email Address: Data Point Intelligence Guide
An email address is an account key, a routing instruction and a reputation record in one string. It is also...
Subdomain: Data Point Intelligence Guide
Organisations defend the domain they advertise and forget the hundred hostnames beneath it. Subdomain enumeration is where the real attack...
URL: Data Point Intelligence Guide
A URL is the only artifact that carries the attacker instruction set in plain sight. Parse it properly and it...
Vulnerability Intelligence (VULNINT): Intelligence Discipline Guide
There are more vulnerabilities than you will ever patch. Vulnerability intelligence exists to tell you which few hundred actually matter...
Threat Actor Intelligence (ACTORINT): Intelligence Discipline Guide
Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what...
Paste Site Intelligence (PASTINT): Intelligence Discipline Guide
Paste sites are where data goes to be shared quickly and forgotten slowly. A dump that lives for eleven minutes...
Network Intelligence (NETINT): Intelligence Discipline Guide
Every packet on the internet is routed by an announcement someone made, on trust. Network intelligence reads those announcements, and...
Malware Intelligence (MALINT): Intelligence Discipline Guide
A malware sample is a confession. It documents what its author wanted, how they build software, and where they expect...
Domain Intelligence (DOMINT): Intelligence Discipline Guide
Domains are the cheapest and most disposable part of an attack, and the most revealing. Registration and DNS leave a...
Dark Web Intelligence (DARKINT): Intelligence Discipline Guide
The dark web is not a place, it is an access-control problem. Most of what matters happens in venues no...
Cyber Intelligence (CYBINT): Intelligence Discipline Guide
Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you...
Certificate Intelligence (CERTINT): Intelligence Discipline Guide
Every publicly trusted TLS certificate is logged in public within seconds of issuance. That log is one of the richest...
Breach Intelligence (BREACHINT): Intelligence Discipline Guide
Most intrusions begin with a password that already worked somewhere else. Breach intelligence is the discipline of knowing which of...
Attack Surface Intelligence (ASMINT): Intelligence Discipline Guide
You cannot defend what you do not know you own. Attack surface intelligence is the discipline of inventorying your exposed...
Healthcare & Drug Security: Mission Domain Intelligence Guide
A hospital that cannot access its imaging system diverts ambulances. A falsified antimalarial with no active ingredient kills quietly, one...
Fraud & Identity: Mission Domain Intelligence Guide
The synthetic identity that just passed your onboarding checks has a credit file, a utility bill and eighteen months of...
Operational Security: Mission Domain Intelligence Guide
Investigations are compromised by their own footprint far more often than by adversary brilliance. A referrer header, a reused persona,...
Cyber Crime: Mission Domain Intelligence Guide
A single business email compromise crew does not need malware. It needs a lookalike domain registered on a Tuesday, a...
