Credential / API Token: Data Point Intelligence Guide
An exposed credential is not a curiosity to explore. It is an incident with a clock running, and the only...
Operational Security
Password / Credential: Data Point Intelligence Guide
An exposed credential is a defensive workload, not an offensive opportunity. The only question worth asking is which of your...
SSL/TLS Certificate: Data Point Intelligence Guide
Adversaries change domains and IPs constantly. They reuse certificate configuration because it is tedious not to. That asymmetry makes the...
Device / Advertising ID: Data Point Intelligence Guide
An advertising identifier was designed to be a resettable, privacy-preserving marketing token. In practice it became one of the most...
Username / Handle: Data Point Intelligence Guide
People change platforms, phones and email providers. They almost never change the handle they picked at fifteen. That inertia is...
Email Address: Data Point Intelligence Guide
An email address is an account key, a routing instruction and a reputation record in one string. It is also...
Subdomain: Data Point Intelligence Guide
Organisations defend the domain they advertise and forget the hundred hostnames beneath it. Subdomain enumeration is where the real attack...
Identity Intelligence (IDENT): Intelligence Discipline Guide
Identity resolution fails in two directions and only one of them is visible. A missed link costs you the investigation;...
Domain Intelligence (DOMINT): Intelligence Discipline Guide
Domains are the cheapest and most disposable part of an attack, and the most revealing. Registration and DNS leave a...
Cyber Intelligence (CYBINT): Intelligence Discipline Guide
Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you...
Certificate Intelligence (CERTINT): Intelligence Discipline Guide
Every publicly trusted TLS certificate is logged in public within seconds of issuance. That log is one of the richest...
Breach Intelligence (BREACHINT): Intelligence Discipline Guide
Most intrusions begin with a password that already worked somewhere else. Breach intelligence is the discipline of knowing which of...
Attack Surface Intelligence (ASMINT): Intelligence Discipline Guide
You cannot defend what you do not know you own. Attack surface intelligence is the discipline of inventorying your exposed...
Insider Threat: Mission Domain Intelligence Guide
The insider case that goes to court usually has a boring first indicator: an access request that was granted because...
Operational Security: Mission Domain Intelligence Guide
Investigations are compromised by their own footprint far more often than by adversary brilliance. A referrer header, a reused persona,...
