We collate information that is relevant to you .

This can be our own or external Threat Intelligence, information about threat actors and their Tactics, Techniques and Procedures (TTPs), but also information from your own environment.

Collate goes a step further. It means bringing information from different sources together and organizing it so that it can be compared, connected and understood.

We want to understand what an attacker can see, what they might be interested in and how they could approach your organisation.

By introducing controlled deceptive elements into your environment we create taillord information.

Information alone is not intelligence.

We analyse what we have found from an attacker's perspective. Who could target you? Why? Which techniques are realistic? And where could those techniques be successful?

Where possible we connect this to frameworks such as MITRE ATT&CK, allowing the intelligence to be used directly by Red, Blue and Purple teams.

Instead of testing everything, we can help start testing what actually makes sense for your threat landscape.

And then we do something with it.

Intelligence can result in improved detection, changes to controls, a Red Team scenario, Purple Team exercises or input for risk management.

But sometimes we want to take it one step further:

• Machine Executable Layer:
  Intelligence becomes automated protection

• Operational Layer:
  Intelligence becomes decisions

• Deception tuning:
  Intelligence improves future intelligence

• Security ecosystem:
  Intelligence strengthens the defense community