Cyber threat intelligence · Cyber indications and warning · Digital footprint and risk
Most security programs buy the tools, then go looking for something to point them at. We work the other way around: decide what you need to know, collect against it, and let the answer drive what gets changed, bought, or watched. Intelligence sets the risk picture. The risk picture sets the spend.
Thirty years of intelligence work — Navy, DC3, Northrop Grumman, Red Sky Alliance — applied to companies and families who are targets but have no analyst of their own.
Why intelligence
Security budgets are finite and adversaries are not. Every program eventually has to decide what it will not protect, what it will not buy, and what it will not watch. Most organizations make those decisions by default — by catalog, by compliance checklist, by whoever presented last. An intelligence function makes them on purpose, against evidence, and writes down the reasoning so it can be judged later.
Detection is retrospective by construction — something has to occur before it alerts. Warning is the only part of the stack that operates before the event, which is the only point at which you still have options.
Buying controls before naming the threat means the threat model exists anyway — it is just implicit, unexamined, and usually inherited from a vendor whose interests are not yours.
Credentials already for sale, a supplier being compromised this week, a principal's address in a broker file, a persona being built to impersonate your CFO. None of it generates a log on your network until it is too late.
Assessments state confidence, grade sources, and name the alternative explanation where evidence is thin. That is what makes them reviewable — and what lets you hold us to them afterward.
Warning buys the one thing money cannot: time to act before the decision gets made for you.
The cycle
Onboarding produces five to nine priority intelligence requirements — each one a question a decision rests on. No requirement, no collection. That single rule is what separates intelligence from a feed subscription.
Priority intelligence requirements: what you must know, written as questions, each tied to a decision, an owner, and a risk.
Managed collection against those requirements — open sources, sector reporting, criminal markets and leak sites, credential exposure, brokers, public records. External and lawful.
Confidence stated, sources graded, alternatives named where the evidence is thin. Fact kept visibly separate from assessment.
Indicators watched against declared thresholds. When one trips, you get the observation, the risk it moves, and the decision it forces.
Your staff or your MSP execute. We score afterward: did the indicator predict, and did it change what you did.
The cycle closes each quarter. Every requirement is re-scored as still relevant, retired, or replaced — which is also how you find out whether you are paying for intelligence or for noise.
Threat against exposure against consequence, stated as something you can argue with — not a color on a heat map.
Everything about your company, your people and their households that an adversary can collect without touching your network.
Named indicators, declared thresholds, and a notification path agreed before anything trips.
A question a decision rests on. Collection exists to answer it, and nothing else.
Credentials, infrastructure, third parties and supply — the surface an adversary already sees.
Knowing early enough that you still have choices. The only output that matters.
What we set out to answer
Onboarding turns worry into priority intelligence requirements — questions a decision rests on, each with an owner and a date. Collection exists to answer them and nothing else. These are the ones that recur across the sectors we work in; your set gets written against your business, and re-scored every quarter.
What we produce
Who targets your sector and by what method, what your digital footprint already exposes, the risks that follow ranked against your tolerance, and the standing requirements that come out of it. The baseline everything else is measured against.
Standing collection against your requirements, a monthly written risk assessment, a warning product the moment a threshold trips, and a quarterly briefing to the board or the owner.
The digital footprint of a named individual and their family: data-broker exposure, doxxing and threat chatter, residence and travel context — what a stranger can assemble, how they would use it, and what comes down first.
Pre-close diligence on a target: breach history, exposed credentials, adversary interest, third-party and supply-chain risk, digital footprint, and the warning items that follow you past closing.
And when you need someone to own it
Intelligence tells you what is coming. Somebody still has to decide what gets fixed, answer the insurer, brief the staff, and run the incident at two in the morning. For companies too small to carry a full-time security executive, that seat is the virtual CISO retainer — and it starts where the intelligence does: I find out what an adversary already knows about you before I recommend a single control.
Every price is fixed or published before the first call. No software sold, no cut of what you buy, and I do not replace your IT.
Published pricing
What drives what
Boundaries
This does not replace an MSSP for security operations or an MSP for running IT. It is the layer neither of them sells: someone whose job is to know what is coming and to say so in writing.
Who this is for
Eight years running an MSSP, with direct operating experience in the first four. I know what an adversary wants from each of them, because I have defended against it.
The risk attaches to the person, not to a company. The digital footprint is the attack surface, and nobody on staff does this work.
CMMC and 800-171 pressure, a prime demanding answers, and a nation-state adversary that is genuinely interested in the program you support.
Drawings, specifications and client property data that are valuable to a competitor and to anyone casing the buildings you designed.
Process knowledge worth stealing, a supply chain worth impersonating, and a plant floor where downtime is measured in shifts.
Deal-timeline pressure and real transaction risk. The cost rides on the deal rather than on operating expense.
Examiners expect a threat intelligence function and a defensible risk assessment. Boards want a named analyst, not another dashboard.
Daily intelligence brief · blog.monadnockcyber.ai
Published every weekday under a byline. Confirmed facts and unverified claims are labeled throughout, with the risk implication called out where there is one. It is a working sample of the product: read a week of it and you will know exactly what you would be buying.
Start here
The self-assessment is free and takes about twenty minutes. You get a scored risk result and the gaps in writing. If the result warrants a conversation, we will have one; if it does not, you still keep the assessment.
Connect
If something looks wrong
Call before you change anything. The evidence worth having is the same evidence that gets destroyed by cleaning up. Answered day or night.