Cyber Threat Intelligence Services

The feed problem

Buying a threat feed is straightforward and rarely helps. A generic feed produces indicators for attacks aimed at industries you are not in, using software you do not run, against defences you do not have. The volume creates an impression of coverage while the one item that mattered goes past with everything else.

Intelligence is only intelligence when it is specific enough to act on. That means starting from your estate, your sector and your suppliers rather than from the wire.

What we provide

Sector and adversary context

Who is actually targeting organisations like yours, how they get in, and what they do once inside, described as techniques rather than group names. Attribution makes for better reading. Techniques make for better detection.

Vulnerability intelligence tied to your estate

Not every published vulnerability, only those affecting software you run, weighted by whether an exploit exists and is being used. A newly exploited flaw in an internet-facing product you operate is worth a phone call. The rest is worth a line in a monthly summary.

Supply chain and third party exposure

Monitoring for incidents affecting your suppliers and the platforms you depend on, because the compromise that reaches you increasingly starts somewhere else.

Brand, domain and credential exposure

Lookalike domain registrations, spoofed portals, and organisational credentials appearing in criminal circulation. Lookalike domains are usually registered a while before they are used, which is one of the few chances to act before anything has happened.

Turning it into detection

Intelligence that stops at a report has not finished. Where a technique is relevant to you, the next step is a detection rule, a hunt, or a configuration change, and we will say plainly which of the three it warrants. Some intelligence justifies engineering work. Most justifies a sentence, and pretending otherwise is how security teams end up busy and no safer.

How it is delivered

A short written summary at an agreed cadence, written for people who are not full-time security analysts, plus direct contact when something needs action before the next report. We would rather send you four pages a month that get read than forty that do not.

Common questions

Is this a threat feed?

No. We are not reselling indicator data. This is analysis scoped to your organisation, and where indicators are relevant we tell you what to do with them rather than shipping you a list.

Do we need a SIEM to make use of this?

No, although it helps. Without one the output is still actionable: configuration changes, patching priorities, awareness of a supplier incident, and blocking decisions. With one, more of the intelligence converts directly into detection.

How is this different from reading the security news?

The news tells you what happened to somebody else. The work here is deciding whether it could happen to you, given what you actually run, and what specifically to change if it could. Most published incidents warrant no action from you at all, and saying so is part of the job.

How often would we hear from you?

Monthly for the written summary, with immediate contact for anything that cannot wait. The threshold for an out-of-cycle alert is agreed at the start, because the useful threshold differs sharply between a manufacturer and a financial services firm.

Can you brief our board?

Yes. Board reporting is a different piece of writing from an analyst summary, and the Cyber Governance Code of Practice has made it a more common request. We will produce the version your directors can govern with.

Cyber threat intelligence