Services / #1 Watch
An analyst learns your business, then monitors the threat groups and campaigns most likely to target it. You get a brief once a month, and a phone call when something can’t wait.
What you get
01
A supplier listed on a leak site. Staff passwords in a new breach dump. A campaign targeting your industry. You hear about it while there is still time to act.
02
Feeds produce thousands of alerts without context. You get one short brief a month that says what changed, why it matters to you, and what to do next.
03
Your analyst knows which vendors you depend on, which systems are fragile and who approves wire transfers. The advice improves as they learn more.
04
Every brief and alert is dated. You can share them with the board, auditors or your insurer when they ask about threat monitoring.
What’s included
How it works
One call to learn the business: systems, vendors, key people and your main concerns.
We document what is already exposed and which threat groups are likely to target you.
We check leak sites, criminal forums, breach data and new domain registrations for anything involving you or your vendors.
A monthly brief and a call, plus an alert whenever something can’t wait until then.
Case study
A manufacturer with a two-person IT team and no intel analyst wanted to know about threats before they became incidents. In month three, a key supplier appeared on a ransomware leak site.
Example engagement. The client is fictional and details are illustrative, to show how this work typically goes.
6 days
warning before the supplier announced its breach
41
staff passwords found in breach data and reset
1 page
monthly brief the IT lead reads each month
The company’s IT lead was handling security alongside everything else. They had a firewall, endpoint protection and an MSP, but no way to know what was happening outside their own network. Their cyber insurer had started asking questions about threat monitoring at renewal.
We started with a kickoff call to learn the business, their main software and the dozen suppliers they depend on most. In the first month we ran a baseline: breach data, lookalike domains, exposed services and the ransomware groups most active against manufacturers.
From then on, we watched leak sites, criminal forums and new domain registrations for the company and its key suppliers, and sent a one-page brief at the end of each month.
The baseline turned up 41 staff passwords in public breach compilations, some of them reused on the company’s VPN login. We flagged them the same week and they were reset.
In month three, a ransomware group listed one of the company’s parts suppliers on its leak site. The supplier hadn’t said anything publicly. We alerted the IT lead that afternoon with what was posted, what the group typically does next and what to check on their side.
The company cut off the supplier’s remote access and reviewed shared accounts before the supplier announced the breach six days later. The insurer got a copy of the monthly briefs at renewal. The IT lead now spends about ten minutes a month on threat intel instead of trying to keep up with feeds.
Related services
Tell us about your situation. We’ll confirm whether this service fits and agree on scope and price before any work starts.