Threat intelligence
The picture before the attack.
Offsecure threat intelligence produces the scenarios a red team should run, built from the stack this organization actually has. It can be the intelligence phase of a red team engagement, or it can stand on its own.
The service follows the intelligence requirement in TIBER and CBEST, where the intelligence phase is separate from the red team phase and is what makes the later attack specific. The result is a set of likely scenarios, written for this security stack.
What is produced
Intelligence is useful when a red team can execute it, or when the organization can act on it without one.
Aligned to the framework
Where the engagement sits under TIBER or CBEST, the intelligence work is built to that requirement.
A separate phase
Intelligence is gathered on its own, then handed to the red team activity it is meant to inform.
Scenarios for this stack
Attack scenarios are written from the security stack and the threats that apply to it, not from a generic catalog.
Where the intelligence comes from
- Sources. Open-source intelligence, proprietary data, and what is known of relevant threat actor behavior, brought together into one profile.
- The consultation. The work starts from the security posture, the threat landscape, and the requirement the organization names.
- The scenarios. Realistic paths, tied to the stack, ready for a red team to simulate.
- The report. Threat profiles, likely vectors, and the scenarios in enough detail to be executed.
- The handover. Delivered into a red team engagement, or delivered on its own for the organization to use internally.
