Threat intelligence.

Most exposure is discoverable before it is used. Credentials surface in dumps and infostealer logs, access to an organization is offered on a forum, a lookalike domain is registered weeks before anyone sends mail from it. The interval between when something appears and when it is acted on is where the useful work sits.

This is the part of the practice that draws most directly on threat-actor and dark web research. Coverage is set against a named list of the people, domains, brands, and infrastructure that actually matter, and reported when something warrants attention rather than on a fixed schedule.

Intelligence that arrives without a recommendation is just news. Each report states what was found, what it most likely means for you specifically, and what to do about it, including the cases where the answer is that nothing needs to be done yet.

Where the collection comes from

Collection here is first-hand. The tooling and the access are built and operated through Skopos Research, the applied research organization behind this practice, developed and maintained over years rather than licensed. A good deal of what is sold as threat intelligence is the same commercial feed resold under a different label, which is why it tends to arrive generic and late. What reaches you here is gathered directly and named to you.

Access of that kind is not a subscription. It rests on tradecraft, on standing that takes time to build and is easy to lose, and on knowing which sources are worth believing and which exist to be believed. The specifics of how it is done are not published, for reasons that will be obvious to anyone who works in this area.

That work has included supporting law enforcement on cybercrime and threat-actor matters. Those engagements are not discussed, but they are the reason the collection is built the way it is: agency work sets a standard for provenance and for knowing where a piece of information came from, and that standard carries over to private clients.

Public bodies engage the practice on the same basis as private clients. Municipal government and law enforcement are welcome to enquire, and requirements peculiar to that setting, including procurement and records obligations, are worked out before anything begins.