Paste / Leak Post: Data Point Intelligence Guide
The paste is usually the first time stolen data touches the open internet, and often the only time before it...
Dark Web Intelligence
Messaging Handle: Data Point Intelligence Guide
A messaging handle outlives phone numbers, domains and marketplaces. It is the thread that ties an operation together across years...
Image / Photograph: Data Point Intelligence Guide
Every photograph makes two claims: this is what it shows, and this is where and when it was taken. Both...
Cryptocurrency Address: Data Point Intelligence Guide
A blockchain address is a pseudonymous account with a permanent, public and complete transaction history. That combination makes it the...
Password / Credential: Data Point Intelligence Guide
An exposed credential is a defensive workload, not an offensive opportunity. The only question worth asking is which of your...
Data Breach: Data Point Intelligence Guide
A breach is not a single event, it is a dataset with a life of its own. The incident ends...
Onion / Hidden Service: Data Point Intelligence Guide
An onion address is a public key, not a location. Everything you can learn about a hidden service comes from...
File Hash: Data Point Intelligence Guide
A file hash is the cheapest reliable fact in cyber threat intelligence: fixed length, unambiguous, and either it matches or...
Username / Handle: Data Point Intelligence Guide
People change platforms, phones and email providers. They almost never change the handle they picked at fifteen. That inertia is...
Vulnerability Intelligence (VULNINT): Intelligence Discipline Guide
There are more vulnerabilities than you will ever patch. Vulnerability intelligence exists to tell you which few hundred actually matter...
Threat Actor Intelligence (ACTORINT): Intelligence Discipline Guide
Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what...
Paste Site Intelligence (PASTINT): Intelligence Discipline Guide
Paste sites are where data goes to be shared quickly and forgotten slowly. A dump that lives for eleven minutes...
Network Intelligence (NETINT): Intelligence Discipline Guide
Every packet on the internet is routed by an announcement someone made, on trust. Network intelligence reads those announcements, and...
Malware Intelligence (MALINT): Intelligence Discipline Guide
A malware sample is a confession. It documents what its author wanted, how they build software, and where they expect...
Domain Intelligence (DOMINT): Intelligence Discipline Guide
Domains are the cheapest and most disposable part of an attack, and the most revealing. Registration and DNS leave a...
Dark Web Intelligence (DARKINT): Intelligence Discipline Guide
The dark web is not a place, it is an access-control problem. Most of what matters happens in venues no...
Cyber Intelligence (CYBINT): Intelligence Discipline Guide
Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you...
Certificate Intelligence (CERTINT): Intelligence Discipline Guide
Every publicly trusted TLS certificate is logged in public within seconds of issuance. That log is one of the richest...
Breach Intelligence (BREACHINT): Intelligence Discipline Guide
Most intrusions begin with a password that already worked somewhere else. Breach intelligence is the discipline of knowing which of...
Attack Surface Intelligence (ASMINT): Intelligence Discipline Guide
You cannot defend what you do not know you own. Attack surface intelligence is the discipline of inventorying your exposed...
Extremism & Radicalization: Mission Domain Intelligence Guide
Radicalisation is not a conveyor belt. It is a set of grievances, communities and content economies, and most of what...
Child Protection: Mission Domain Intelligence Guide
The pattern that ends most sextortion cases is depressingly consistent: contact within hours, escalation within a day, and a payment...
Drug Trafficking: Mission Domain Intelligence Guide
A cluster of six overdoses in one town over a weekend is not a public health footnote. It is the...
Dark Web Intel: Mission Domain Intelligence Guide
Most of what is posted on a criminal forum is advertising. The intelligence value is not in the claim but...
Ransomware: Mission Domain Intelligence Guide
A leak site countdown is a negotiating instrument, not a report. Half the value of ransomware intelligence lies in knowing...
