Cyber threat intelligence · Cyber indications and warning · Digital footprint and risk
Most security programs buy the tools, then go looking for something to point them at. We work the other way around: decide what you need to know, collect against it, and let the answer drive what gets changed, bought, or watched. Intelligence sets the risk picture. The risk picture sets the spend.
Thirty years of intelligence work — Navy, DC3, Northrop Grumman, Red Sky Alliance — applied to companies and families who are targets but have no analyst of their own.
The cycle
Onboarding produces five to nine priority intelligence requirements — each one a question a decision rests on. No requirement, no collection. That single rule is what separates intelligence from a feed subscription.
Priority intelligence requirements: what you must know, written as questions, each tied to a decision, an owner, and a risk.
Managed collection against those requirements — open sources, sector reporting, criminal markets and leak sites, credential exposure, brokers, public records. External and lawful.
Confidence stated, sources graded, alternatives named where the evidence is thin. Fact kept visibly separate from assessment.
Indicators watched against declared thresholds. When one trips, you get the observation, the risk it moves, and the decision it forces.
Your staff or your MSP execute. We score afterward: did the indicator predict, and did it change what you did.
The cycle closes each quarter. Every requirement is re-scored as still relevant, retired, or replaced — which is also how you find out whether you are paying for intelligence or for noise.
Threat against exposure against consequence, stated as something you can argue with — not a color on a heat map.
Everything about your company, your people and their households that an adversary can collect without touching your network.
Named indicators, declared thresholds, and a notification path agreed before anything trips.
A question a decision rests on. Collection exists to answer it, and nothing else.
Credentials, infrastructure, third parties and supply — the surface an adversary already sees.
Knowing early enough that you still have choices. The only output that matters.
What we produce
Who targets your sector and by what method, what your digital footprint already exposes, the risks that follow ranked against your tolerance, and the standing requirements that come out of it. The baseline everything else is measured against.
Standing collection against your requirements, a monthly written risk assessment, a warning product the moment a threshold trips, and a quarterly briefing to the board or the owner.
The digital footprint of a named individual and their family: data-broker exposure, doxxing and threat chatter, residence and travel context — what a stranger can assemble, how they would use it, and what comes down first.
Pre-close diligence on a target: breach history, exposed credentials, adversary interest, third-party and supply-chain risk, digital footprint, and the warning items that follow you past closing.
And when you need someone to own it
Intelligence tells you what is coming. Somebody still has to decide what gets fixed, answer the insurer, brief the staff, and run the incident at two in the morning. For companies too small to carry a full-time security executive, that seat is the virtual CISO retainer — and it starts where the intelligence does: I find out what an adversary already knows about you before I recommend a single control.
Every price is fixed or published before the first call. No software sold, no cut of what you buy, and I do not replace your IT.
Published pricing
What drives what
Boundaries
This does not replace an MSSP for security operations or an MSP for running IT. It is the layer neither of them sells: someone whose job is to know what is coming and to say so in writing.
Who this is for
Eight years running an MSSP, with direct operating experience in the first four. I know what an adversary wants from each of them, because I have defended against it.
The risk attaches to the person, not to a company. The digital footprint is the attack surface, and nobody on staff does this work.
CMMC and 800-171 pressure, a prime demanding answers, and a nation-state adversary that is genuinely interested in the program you support.
Drawings, specifications and client property data that are valuable to a competitor and to anyone casing the buildings you designed.
Process knowledge worth stealing, a supply chain worth impersonating, and a plant floor where downtime is measured in shifts.
Deal-timeline pressure and real transaction risk. The cost rides on the deal rather than on operating expense.
Examiners expect a threat intelligence function and a defensible risk assessment. Boards want a named analyst, not another dashboard.
Daily intelligence brief · blog.monadnockcyber.ai
Published every weekday under a byline. Confirmed facts and unverified claims are labeled throughout, with the risk implication called out where there is one. It is a working sample of the product: read a week of it and you will know exactly what you would be buying.
Start here
The self-assessment is free and takes about twenty minutes. You get a scored risk result and the gaps in writing. If the result warrants a conversation, we will have one; if it does not, you still keep the assessment.
Connect
If something looks wrong
Call before you change anything. The evidence worth having is the same evidence that gets destroyed by cleaning up. Answered day or night.