Vorpsel / Services / Intelligence and advisory
Threat intelligence
Information about threats is only useful when it changes a decision. We tell you who is targeting companies like yours, how they operate, what of yours is already exposed and what to do about it.
At a glance
- For security teams and leaders who need to prioritize with context
- Format a one-time threat assessment, or monthly reporting
- Sources public research, leak monitoring and what we see in our own platform
- Output actions for the technical team and a summary for leadership
Not another feed of indicators
Lists of malicious addresses and file hashes have their place, and the Vorpsel platform already uses them. But a list does not tell you which threats deserve your budget this quarter.
This service is written for your company. We start from your sector, your country, your technology and your exposure on the internet, and end with a short list of things to change: a control to add, a detection to write, a credential to reset.
Questions this service answers
Who would attack us?
Which groups have targeted companies of your sector and size, and what they were after.
How would they get in?
The techniques they used most, compared with the controls you have today.
What of ours is already out there?
Leaked credentials, forgotten systems and domains that imitate your brand.
Does this new vulnerability matter to us?
Whether it is being exploited, against whom, and whether you run the affected technology.
Is this domain or email a threat?
A written answer about a specific item your team found suspicious.
Where should the next budget go?
The controls that would stop the most likely attacks against you, in order.
What the service covers
Threat landscape for your sector
Which groups have attacked companies in your sector and region, what they were after and which techniques they used to get in and move around.
- Profiles of the groups most relevant to you, with their known techniques mapped to MITRE ATT&CK
- Recent incidents in your sector and what they teach
- Which of those techniques your current controls would and would not stop
Exposure of your company
What an attacker can learn about you before the first attempt: forgotten systems, leaked credentials, impersonating domains and information that makes phishing easier.
- Employee credentials found in public leaks, so they can be reset
- Domains registered to look like yours, for phishing or fraud
- Internet-facing systems you may not know about
Vulnerability context
When a serious vulnerability is announced, the question is whether it matters to you and how fast. We answer with what we know about its exploitation and where it exists in your environment.
- Short notes on new critical vulnerabilities that affect your technology
- Whether exploitation has been seen, and against whom
Questions on demand
On a monthly plan, your team can ask us about a suspicious domain, a strange email, a new group in the news or a rumor of a leak, and receive a written answer.
How it works
We only collect information that is public or that you give us. We do not access systems that are not yours, and we do not buy stolen data.
Profile
We learn your business, the data and systems that matter most and the domains and brands you own.
Research
We study the threats relevant to that profile and look for your exposure in public sources and leaks.
Report and act
We present the findings, with the actions in order, and follow up on what was done in the next cycle.
What you receive
Threat profile
The groups and techniques most relevant to you, mapped to MITRE ATT&CK, with what your controls would stop.
Exposure report
Leaked credentials, impersonating domains and internet-facing systems linked to your company.
Monthly briefing
On the monthly plan, a short report on what changed, with the actions for that month.
Urgent notices
A direct message when something needs action now, such as credentials of your staff in a new leak.
Ways to work with us
Start with a one-time assessment and keep the monthly service if it proves useful.
| Option | Best for | What it includes |
|---|---|---|
| Threat assessment | A first, complete picture of the threats to your company | Threat profile, exposure report and a presentation of the findings |
| Monthly service | Staying current as threats and your company change | Monthly briefing, urgent notices and questions on demand |
Questions
How is this different from the intelligence in the Vorpsel platform?
The platform uses threat lists automatically, for example to alert when a machine contacts a known malicious address. This service is analysis done by people, about your company, to guide decisions.
What happens if you find our credentials in a leak?
We tell you right away, through a private channel, which accounts are affected and where they appeared, so they can be reset. Passwords are never included in reports.
Who reads the reports?
Each report has two parts: technical detail for the security and IT teams, and a one-page summary for leadership with the risks and the decisions needed.
Can you monitor our brand on social networks?
We look for domains and pages that imitate your brand for phishing or fraud. Broader brand monitoring on social networks is outside this service.
Other services
Tell us what you need.
We reply with a few questions about scope, then send a proposal with dates and price.