Password / Credential: Data Point Intelligence Guide
An exposed credential is a defensive workload, not an offensive opportunity. The only question worth asking is which of your...
CVE / Vulnerability
Data Breach: Data Point Intelligence Guide
A breach is not a single event, it is a dataset with a life of its own. The incident ends...
Onion / Hidden Service: Data Point Intelligence Guide
An onion address is a public key, not a location. Everything you can learn about a hidden service comes from...
File / Document: Data Point Intelligence Guide
Every file carries more than its content. The container, the metadata and the structure record how it was made and...
Malware Family: Data Point Intelligence Guide
A malware family name is an analytical claim, not a fact stamped on the binary. It is the most useful...
SSL/TLS Certificate: Data Point Intelligence Guide
Adversaries change domains and IPs constantly. They reuse certificate configuration because it is tedious not to. That asymmetry makes the...
CVE / Vulnerability: Data Point Intelligence Guide
A CVE identifier is a label for a flaw, not a measure of your risk. Treating the two as the...
File Hash: Data Point Intelligence Guide
A file hash is the cheapest reliable fact in cyber threat intelligence: fixed length, unambiguous, and either it matches or...
Signals Intelligence (SIGINT): Intelligence Discipline Guide
Signals intelligence is a state function with a warrant behind it. For everyone else, the discipline still matters, because you...
Energy Intelligence (ENERGYINT): Intelligence Discipline Guide
Energy is where physics, contracts and politics meet, and all three leave records. Energy intelligence reads the flows and the...
Risk Intelligence (RISKINT): Intelligence Discipline Guide
Risk intelligence is what stops a briefing ending with it depends. It converts what you know, and what you do...
Open Source Intelligence (OSINT): Intelligence Discipline Guide
Open source is not free intelligence. It is unvalidated raw material available to anyone, including your adversary, and the discipline...
Vulnerability Intelligence (VULNINT): Intelligence Discipline Guide
There are more vulnerabilities than you will ever patch. Vulnerability intelligence exists to tell you which few hundred actually matter...
Threat Actor Intelligence (ACTORINT): Intelligence Discipline Guide
Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what...
Cyber Intelligence (CYBINT): Intelligence Discipline Guide
Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you...
Critical Infrastructure: Mission Domain Intelligence Guide
In an office network the worst outcome is data loss. On a substation or a water treatment line the worst...
Threat Analysis: Mission Domain Intelligence Guide
An indicator list is not intelligence. Intelligence is a judgement, held to a stated confidence, that changes what a decision-maker...
APT / Espionage: Mission Domain Intelligence Guide
The median intrusion that matters is not loud. It is a valid credential, a legitimate administrative tool and eleven months...
Nation State: Mission Domain Intelligence Guide
State activity rarely arrives labelled. It surfaces as a procurement order routed through a third-country freight forwarder, a research institute...
