Know who is coming for you, and how.
Targeted intelligence on the people and groups most likely to target your business: what they want, how they work, and where your estate is exposed to their methods. A briefing, not a feed.
The actors who hit your sector, and your exposure to them.
A feed tells you what happened to someone else. This names the groups that hit your sector, what they go after, and the tradecraft they use to get it.
Then it turns that toward your estate: where you are exposed to exactly those methods, worked through by people who run those methods themselves.
- Who
- A ransomware affiliate working regional banks and payment firms, two intrusions in your sector this year.
- Wants
- The payment rails, then the backups, in that order.
- How
- Phished VPN credentials, a quiet week on the admin share, then the domain.
- Where you are exposed
- Two credentials in a leak set, one VPN appliance nobody owns, a supplier with standing access.
From actor profile to attack path.
Actor profiles for your sector
Who they are, what they want, and how they have operated against firms like yours.
Your external exposure, as an attacker sees it
Leaked credentials, forgotten assets, suppliers and the trust you extend them.
The threat-intelligence phase of threat-led testing
Under DORA and TIBER-EU, the test starts from exactly this work.
Executive exposure
What is findable about the people an attacker would impersonate or target first.
Identified for threat-led testing? DORA TLPT: the full programme →
Scoped from the question. Delivered twice.
- 01
Scoped from the question
Which decision the intelligence has to inform.
- 02
Collected
Open and commercial sources, our own research, and nothing unlawful.
- 03
Delivered twice
A written briefing and a spoken one, with time for the questions the written one raises.
A senior analyst owns it from the first scoping conversation to the spoken briefing, and is the one who answers when the board asks what it means.
A briefing the board can read.
A briefing the board can read
Written for the people who fund the response, not only the people who run it.
The attack paths an actor would actually use
Against you, in order of how likely they are to try them.
The exposure list, ranked
What to close first, and what can wait.
The test plan, if a red team follows
The scenarios already written, so the engagement starts on day one.
What every engagement includes.
Not a tier you pay extra for. Every client gets it.
Help beyond the scope
A problem outside what you hired us for? If we can help, we will.
Seniors on call
Reach the people who did the work, any time, for as long as you need them.
What our seniors learn here is encoded into Incenter: every engagement makes the engine smarter.