Cyber Intelligence

What the discipline covers

• Analysis of the digital exposure surface: domains, subdomains, visible services, forgotten assets.
• Brand impersonation monitoring: lookalike domains, fraudulent websites, fake profiles.
• Exposure of corporate credentials and data appearing in third-party breaches.
• Exposure profile of people with access or decision authority, the usual basis of targeted social engineering.
• Threat context: tactics observed against the sector, not attribution of specific campaigns.

Scope

• External attack surface of the organisation, its brands and its publicly linked subsidiaries.
• Exposure of named individuals only where a security purpose justifies it, with data minimisation.
• Third-party exposure that reaches the organisation indirectly through a supplier or partner.
• Explicit exclusions: no credential testing, no intrusion, no acquisition or storage of breach dumps.

Main risks and threats

• Targeted fraud built on published organisational detail: impersonation of executives, suppliers or payment instructions.
• Reuse of leaked corporate credentials against internal services.
• Fraudulent sites and lookalike domains used to harvest customer or employee credentials.
• Forgotten infrastructure that remains reachable and unmonitored.
• Suppliers whose own exposure becomes an entry route into the organisation.
• Aggregation: individually harmless publications that together enable a credible pretext.

Relevant indicators and warning signs

• Recent registration of domains similar to the corporate one, a frequent precursor to fraud or impersonation.
• Corporate credentials present in old breaches and reused across internal services.
• Executives and finance staff with enough public exposure to support a believable pretext.
• Orphaned digital assets: test environments, subdomains and panels with no assigned owner.
• Publication of internal structure, approval chains or payment calendars in public sources.
• Suppliers with public incidents that indirectly affect the organisation.

Application of OSINT

• Inventory of externally visible assets using public domain and certificate records.
• Monitoring of new domain registrations and certificates showing similarity to the brand.
• Exposure assessment of key individuals, with data minimisation and a strictly security-related purpose.
• Reconstruction of the plausible attack scenario: what information would make a targeted attempt credible.
• Prioritisation by impact on the organisation and by real ease of exploitation, not by number of findings.

Zero101OSINT methodology

• Agreement on the perimeter to be reviewed: brands, domains, subsidiaries and roles in scope.
• Passive collection only: nothing is queried, tested or authenticated against the organisation's systems.
• Corroboration of every finding with attached, reproducible evidence and its collection date.
• Aggregation analysis, because the risk usually lies in the combination and not in any single item.
• Prioritised remediation plan, distinguishing what can be withdrawn from what can only be mitigated.
• Re-measurement after remediation, so the reduction in exposure can be demonstrated internally.

Open sources used

• Public domain records, certificate transparency logs and network range allocation data.
• Public vulnerability advisories and official incident communications.
• Published corporate content, professional networks and publicly accessible code repositories.
• Verifiable information about already disclosed breaches, without acquiring or processing data dumps.
• Reports with attached evidence, criticality classification and actionable reduction measures.

Applications for companies, organisations and security decision-makers

• Understand real exposure before investing in more defensive technology.
• Reduce the viability of fraud based on impersonation of executives and suppliers.
• Bring external judgement to third-party and acquisition due diligence.
• Justify security priorities to management with verifiable evidence rather than hypotheses.
• Give an awareness programme concrete, organisation-specific material instead of generic examples.

Products or analytical outputs Zero101OSINT can provide

• Corporate digital exposure report with findings, evidence and a prioritised reduction plan.
• Individual exposure assessment for executives and staff with sensitive access.
• Digital risk review of a third party before contracting or integrating it.
• Periodic monitoring of lookalike domains and of newly appearing exposure.

Legal, ethical and reliability limitations