Domain Name: Data Point Intelligence Guide
A domain name is the cheapest thing an adversary buys and the most expensive thing for them to keep clean....
Threat Actor Intelligence
Threat Actor Intelligence (ACTORINT): Intelligence Discipline Guide
Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what...
Disinformation / IO: Mission Domain Intelligence Guide
Two hundred accounts posted the same seven-word phrase within ninety seconds. None of them had existed six weeks earlier. The...
Extremism & Radicalization: Mission Domain Intelligence Guide
Radicalisation is not a conveyor belt. It is a set of grievances, communities and content economies, and most of what...
Counter-Terrorism: Mission Domain Intelligence Guide
Attack planning leaves a logistics trail before it leaves an ideological one: a rented van, a chemical purchase, a reconnaissance...
Economic Espionage: Mission Domain Intelligence Guide
Industrial espionage rarely looks like a break-in. It looks like a departing researcher, a joint venture with an unusual data...
Gangs & Street Crime: Mission Domain Intelligence Guide
Retaliation after a stabbing is usually measured in days, sometimes hours. The intelligence question is not who did it but...
Organized Crime: Mission Domain Intelligence Guide
Organised crime leaves paperwork. Not confessions, but a notary who appears in eleven unrelated share transfers, a haulage firm with...
Threat Analysis: Mission Domain Intelligence Guide
An indicator list is not intelligence. Intelligence is a judgement, held to a stated confidence, that changes what a decision-maker...
Malware: Mission Domain Intelligence Guide
A hash tells you a file was seen. A configuration extraction tells you the campaign identifier, the operator's infrastructure and,...
Dark Web Intel: Mission Domain Intelligence Guide
Most of what is posted on a criminal forum is advertising. The intelligence value is not in the claim but...
Ransomware: Mission Domain Intelligence Guide
A leak site countdown is a negotiating instrument, not a report. Half the value of ransomware intelligence lies in knowing...
Cyber Crime: Mission Domain Intelligence Guide
A single business email compromise crew does not need malware. It needs a lookalike domain registered on a Tuesday, a...
APT / Espionage: Mission Domain Intelligence Guide
The median intrusion that matters is not loud. It is a valid credential, a legitimate administrative tool and eleven months...
Nation State: Mission Domain Intelligence Guide
State activity rarely arrives labelled. It surfaces as a procurement order routed through a third-country freight forwarder, a research institute...
