Security teams have more vulnerability data at their disposal than ever. But even the best intelligence has limited value if teams can’t determine where those vulnerabilities exist within their own environment.

For many organizations, that visibility remains a challenge. Asset inventories, scanners, and ticketing systems provide valuable information, but connecting those insights with real-world exploit activity isn’t always straightforward. And as environments evolve, undocumented assets, forgotten infrastructure, and newly exposed systems can introduce risks that traditional inventories may miss.

Flashpoint External Attack Surface Management (EASM) helps close that gap by connecting continuous discovery of internet-facing assets with Flashpoint’s threat-informed Vulnerability Intelligence. With coverage of more than 480,000 vulnerabilities, including over 105,000 not found in NVD or CVE, Flashpoint provides context on active exploitation, exploit maturity, and ransomware risk through its patented Ransomware Risk model. Together, these capabilities help teams identify which exposures warrant the most immediate attention.

What is EASM? External Attack Surface Management (EASM) is the continuous discovery and monitoring of an organization’s internet-facing assets, including domains, subdomains, IPs, and infrastructure that isn’t formally tracked. It gives security teams visibility into what’s exposed to the internet, whether or not that infrastructure was deliberately set up or documented.

How EASM Extends Vulnerability Prioritization to Your Full Environment

EASM continuously discovers internet-facing assets associated with an organization, including domains, subdomains, IP addresses, and infrastructure that may not appear in existing inventories. This could include a subsidiary’s infrastructure following an acquisition, a forgotten staging environment, or a cloud instance that remains active long after a project ends.

With Flashpoint EASM, discovered assets enter a triage queue organized by relevance, helping teams focus on assets that warrant further investigation. Once ownership is confirmed, Flashpoint maps those assets against its Vulnerability Intelligence to identify vulnerabilities associated with the software versions running on them.

Findings are prioritized using Flashpoint KEV, EPSS, and Ransomware Risk scores. Asset-level details also show the products and versions responsible for identified exposures, along with potentially high-risk open ports such as RDP and SSH. This gives teams the context they need to assess risk and determine where remediation should begin.

Example Scenario

Consider a development team that deploys a staging server running an outdated web framework. The project ends, but the server remains online and is never added to the organization’s asset inventory.

Flashpoint EASM discovers the server and shows how it connects to the organization’s infrastructure. Once the team confirms ownership, Flashpoint Vulnerability Intelligence identifies an actively exploited CVE affecting the framework version.

The team can now investigate an exposure that might otherwise have gone unnoticed and prioritize remediation based on evidence of active exploitation.

Why This Matters More in Regulated Industries

For organizations in heavily regulated industries such as financial services and healthcare, incomplete asset visibility can introduce additional compliance and security risks. Requirements under frameworks and regulations such as GLBA and HIPAA make maintaining appropriate safeguards especially important. An unknown, internet-facing asset with an exploitable vulnerability can create exposure regardless of whether it appears in the organization’s CMDB.

Mergers and acquisitions can complicate this further. Acquired organizations bring infrastructure that security teams may have limited visibility into, including assets that have not yet been incorporated into existing monitoring processes.

Continuous external asset discovery helps teams identify and assess that infrastructure earlier, reducing reliance on periodic audits or manual inventory updates to uncover potential exposures.

Discovery and Prioritization, Built Into One Platform

When attack surface discovery and vulnerability intelligence operate in separate systems, security teams may need to manually correlate asset inventories with vulnerability findings. That process becomes increasingly difficult as infrastructure changes and new vulnerabilities emerge.

Flashpoint brings these capabilities together in one platform, an approach we call attack surface intelligence. Newly discovered assets can be evaluated against Flashpoint’s Vulnerability Intelligence, giving teams access to threat-informed prioritization within the same workflow.

For teams already using Flashpoint Vulnerability Intelligence, EASM can be added as a module within the existing Ignite platform, with no separate console to manage. Contact your account team to learn more about adding EASM to your deployment. New to Flashpoint? Schedule a demo to explore how Vulnerability Intelligence and EASM work together to help your team identify and prioritize external exposures.

Frequently Asked Questions

How is EASM different from a vulnerability scanner? 

Traditional vulnerability scanners scan assets you already know about and tell them to check, typically from inside the network perimeter. EASM continuously discovers internet-facing assets from the outside, including unknown infrastructure like forgotten test environments and acquired systems, then enriches them with vulnerability intelligence beyond public sources like NVD and CVE. The two are complementary: scanners provide depth on known internal assets, while EASM extends that visibility to what’s exposed externally.

Can EASM help identify compound risk on a single asset? 

Yes. The Vulnerable Assets view surfaces how many vulnerabilities are tied to a given asset, so teams can quickly spot assets carrying disproportionate risk and prioritize accordingly, rather than treating every finding as an isolated issue.

If we’re already running Flashpoint Vulnerability Intelligence, do we need a new implementation to add EASM? 

No. EASM is a module inside the platform you’re already using. It appears inside the same Ignite workflows your team relies on today, with no separate console or parallel rollout required.

How is EASM priced?

EASM is priced based on company size rather than asset count or seats, so costs are predictable and don’t scale up just because the attack surface grows.

Contact Sales

Blogs

Blog

How to Align and Measure Threat Intelligence Operations: Flashpoint Priority Intelligence Requirements

In this post, we explore how Flashpoint’s new Intelligence Requirements capability helps organizations define, manage, and operationalize PIRs directly within Ignite by connecting intelligence priorities, monitoring activity, investigations, and measurable operational outcomes into a more unified workflow.

For many intelligence teams, the hardest part of the intelligence lifecycle is no longer collection. It is operationalization.

Analysts are flooded with incoming activity every day, from credential exposures and actor chatter to vulnerability reporting and operational alerts. But without a structured way to connect those signals to business priorities and operational risk, many organizations still struggle to translate intelligence activity into actionable decisions and measurable outcomes.

That is exactly the problem Intelligence Requirements (IRs) are designed to solve.

With the introduction of Intelligence Requirements in Flashpoint Ignite, organizations can define, manage, and operationalize both General Intelligence Requirements (GIRs) and Priority Intelligence Requirements (PIRs) directly within their day-to-day intelligence workflows. By bringing intelligence priorities, monitoring activity, investigations, and reporting into a more unified operational model, teams can create clearer alignment between intelligence operations and organizational risk.

With Intelligence Requirements, organizations can:

• Centralize and structure General Intelligence Requirements and Priority Intelligence Requirements (PIRs) directly within Ignite to create clearer alignment across intelligence operations.
• Connect alerts and monitoring activity to business priorities and organizational risk to improve focus and prioritization.
• Tie intelligence findings directly to Investigations workflows to support faster triage, collaboration, and response.
• Accelerate adoption with pre-built PIR templates or create custom intelligence requirements tailored to organizational priorities.
• Gain measurable visibility into intelligence activity, investigative trends, and how CTI supports operational and business outcomes.

“The most effective threat intelligence programs are the ones aligned directly to the priorities that matter most to an organization — from reducing operational risk to enhancing executive and mission-level decision-making,” said Josh Lefkowitz, Co-Founder and CEO of Flashpoint. “With Intelligence Requirements, Flashpoint is helping organizations with the critical effort to define and operationalize those priorities across intelligence workflows — creating a clearer connection between threat intelligence programs and outcomes.”

Turning Intelligence Priorities Into Operational Workflows

At its core, a Priority Intelligence Requirement represents a question an organization needs answered.

Examples might include:

• Are credentials tied to our organization appearing in underground communities?
• Is a ransomware group targeting organizations in our industry?
• Are discussions about our executives increasing across threat actor forums?
• Is new malware infrastructure emerging that overlaps with our environment?

Historically, PIRs have existed outside operational workflows entirely — tracked through spreadsheets, slide decks, ticketing systems, or institutional knowledge spread across analyst teams. Meanwhile, alerting, investigations, and reporting frequently operated across disconnected processes, making it difficult to maintain clear alignment between intelligence activity and organizational priorities.

The challenge is, as intelligence programs scale, that fragmentation creates operational friction. Analysts spend more time organizing workflows, managing signals, and explaining priorities instead of focusing on the intelligence questions that matter most.

Inside Ignite, Intelligence Requirements provide a more structured operational framework that connects:

• Intelligence priorities
• Monitoring activity
• Investigations
• Triage workflows
• Collaboration
• Operational outcomes

Building Signals Around Intelligence Questions

Once an Intelligence Requirement is defined, teams can begin building the signals designed to answer that requirement.

This transforms the role alerting plays within intelligence operations.

Rather than creating isolated alerts with little context, analysts can associate alerts directly to specific Intelligence Requirements. Those alerts become observable signals tied to the intelligence questions the organization is trying to answer.

For example:

• A credential exposure alert may support an identity-focused PIR
• Ransomware reporting alerts may support an executive risk PIR
• Actor chatter or malware discussions may support a geopolitical monitoring PIR

This creates significantly more clarity for analysts:

• Why does this alert exist?
• What intelligence priority does it support?
• Which signals are actually producing meaningful operational value?

As intelligence programs mature, that visibility becomes increasingly important beyond the analyst team itself. Security leaders are under growing pressure to explain how intelligence activity supports operational priorities, business risk reduction, and executive decision-making.

By organizing alerts around intelligence requirements instead of individual datasets alone, organizations gain a more operational view of intelligence activity and its relevance to broader business objectives.

Creating a Stronger Feedback Loop Between Monitoring and Prioritization

One of the biggest challenges intelligence teams face today is alert fatigue.

Large volumes of alerts can overwhelm analysts and obscure the signals most relevant to operational risk. Over time, this makes it harder to prioritize analyst attention, refine monitoring strategies, and understand which intelligence activity is actually producing operational value.

Intelligence Requirements help bring more structure and context to monitoring workflows by connecting incoming activity directly to defined intelligence priorities.

Instead of reviewing alerts in isolation, analysts can evaluate activity within the context of the PIRs it supports. This gives teams clearer visibility into:

• Which signals consistently produce meaningful intelligence
• Where noisy monitoring workflows are slowing analysts down
• Which intelligence priorities are driving the most operational activity
• How analyst effort aligns to organizational risk

Over time, this creates a stronger operational feedback loop. Monitoring workflows can be refined based on investigative outcomes, low-value signals become easier to identify, and teams gain a clearer understanding of which intelligence activity deserves the most attention.

The result is a more intentional and measurable approach to intelligence monitoring that helps analysts spend less time managing noise and more time focusing on operationally relevant signals.

Connecting Intelligence Activity to Collaborative Investigations

Prioritizing signals is only part of the workflow.

When activity warrants deeper analysis, analysts can move directly from alert triage into Investigations within Ignite. This is where Intelligence Requirements begin connecting monitoring activity to collaborative operational response.

Investigations provide a centralized environment where teams can organize findings, preserve investigative context, track evolving activity, coordinate across stakeholders, and develop operational reporting around emerging threats.

Importantly, investigations remain connected back to the original Intelligence Requirement, helping preserve the broader operational context behind the work and maintain alignment between investigative activity and organizational priorities.

This creates a more continuous operational process:

1. Define the intelligence question
2. Build monitoring workflows around relevant signals
3. Prioritize incoming intelligence
4. Escalate meaningful findings into investigations
5. Collaborate, analyze, and report on operational activity
6. Refine monitoring workflows based on outcomes

Within Ignite, analysts can also leverage AI Workspace capabilities to accelerate analysis, summarize investigative findings, and support downstream reporting workflows.

By connecting monitoring, investigations, collaboration, and analysis within the same operational framework, organizations gain a clearer understanding of how intelligence activity supports operational decision-making and business risk management.

Supporting More Mature Intelligence Operations

As threat environments become more complex, operational maturity increasingly depends on an organization’s ability to connect priorities, monitoring activity, investigations, and outcomes within the same framework.

That challenge extends beyond the analyst team itself. Intelligence leaders are increasingly expected to demonstrate how intelligence activity supports operational priorities, informs risk decisions, and contributes to broader business objectives.

Intelligence Requirements help organizations create a more structured and measurable operational model by connecting intelligence priorities directly to monitoring workflows and investigations inside Ignite.

Over time, this gives organizations clearer visibility into:

• which priorities are generating operational activity
• where analysts are spending investigative effort
• how intelligence supports organizational risk management
• how CTI workflows contribute to operational and business outcomes

By reducing fragmentation across workflows and maintaining stronger alignment between intelligence activity and organizational priorities, teams can spend less time managing process and more time focusing on the intelligence questions most relevant to the business.

Learn more about Flashpoint Intelligence Requirements and request a demo.

Request a demo today.

Video as Essential Threat Intelligence

When advertising and selling their services, or boasting about their exploits, threat actors will often post media, including video, to illicit communities that serve as proof points for potential buyers and partners.

They showcase sensitive information and stolen goods, including: stolen identities, compromised bank accounts, checks, and stolen credit cards; gift cards and receipts; fake, unlicensed merchandise; ATM skimmers and shimmers, guns and drugs, exploit code, RDP access, brand impersonation, physical security threats, and much more.

Now, video use amongst threat actors is on the rise, as media-rich, mobile-first communication is becoming a primary mode of communication in illicit communities. Gaining visibility into this threat landscape is essential intelligence to CTI, Fraud, Brand Protection, and Physical Security teams, among other practitioners whose job it is to protect against exposure to fraud, corporate brand abuse, and acts of violence: 

Even better is having a way to search this media across text, images, and video in order to identify potential threats. Flashpoint offers all three—and our new video search analysis is a unique offering on the market.

What is Flashpoint Video Search Technology?

Building on the success of our OCR capability for images, security teams can now surface threats in videos posted by threat actors using object detection, logo detection, text extraction, and explicit content detection directly within the Flashpoint Intelligence Platform.

Security teams across various industries in public and private sectors have realized the value of searching for, and being alerted on, images of company assets that pop up on open-source and darknet communities. Flashpoint’s video search analysis expands the scope of coverage, offering additional insights into a fast-growing medium used by threat actors.

What Can It Identify?

Video search analysis gives teams the ability to search for and generate keyword specific alerts for text, logos, and organizational assets inside videos across Flashpoint intelligence collections. Flashpoint’s new video search analysis helps to identify: 

• Labels and objects, including products, locations, activities, and animal species
• Logos, including a library of more than 100,000 brand-specific media
• Text, including the detection and extraction of text within an input video using OCR
• Explicit content, including adult content in videos, which is generally defined as inappropriate for people under the age of 18

What Can Flashpoint Video Search Identify?

Video search analysis equips security teams with the additional tools and intelligence they need in their missions of preventing fraud and protecting their organization.

Financial Fraud

Search for a bank or institution name to discover videos with that particular logo or text in them. Locate a threat actor boasting about ATM access, logos or text on a check or receipts, or of a physical brick and mortar building. Video search analysis can be used to uncover instances of threat actors engaging in using ATMs to extract cash, duplicating false checks, credit card fraud, and POS skimmers. 

Additionally, Flashpoint financial services customers have found countless instances of potentially fraudulent accounts, checks, and cards using image OCR—and our new video search analysis functionality will only enhance and increase the ability to prevent financial fraud. One Flashpoint financial services customer detected more than $4M in illicitly marketed assets, including checks and compromised accounts, using our OCR capabilities.

Physical Security 

Enhance executive protection by monitoring for specific personally identifiable information (PII) related to employees, executives, and organizations. With this, physical security teams can work to prevent acts of violence and crimes or threats at points of interest, events, or physical locations. 

Brand Protection

Monitor for an organization’s brand in videos shared by illicit actors, including the ability to identify insider threats via videos of compromised web servers, compromised customer accounts, and stolen merchandise. 

Access Flashpoint Video Search Today

Learn more about how Flashpoint’s industry-first video search technology can help your teams surface logos, text, explicit content, and other critical intelligence.

Frequently Asked Questions (FAQs)

What is Flashpoint Video Search and how does it help investigators?

Flashpoint Video Search is an industry-first technology within the Flashpoint Intelligence Platform that allows users to search for specific objects, text, and logos inside video files. It helps investigators by surfacing critical intelligence from videos posted in illicit communities, such as threat actors boasting about stolen bank accounts, showing off illegal weapons, or demonstrating how to use POS skimmers.

Flashpoint Video Search Capability	Investigative Benefit
Logo Detection	Identifies a library of 100,000+ brand logos inside video frames.
Text Extraction (OCR)	Reads and pulls text, such as names on checks or credit cards, from video.
Object Labeling	Detects physical items like ATM skimmers, guns, or specific products.

How does Flashpoint Video Search assist in preventing financial fraud?

Flashpoint Video Search assists in preventing financial fraud by allowing banks and institutions to scan for their brand names and assets in videos shared on the dark web. Fraud teams can use Flashpoint to find threat actors showcasing “proof” of their exploits, such as videos of cash being extracted from compromised ATMs or close-ups of stolen checks and credit cards, enabling the bank to cancel those assets immediately.

• Asset Recovery: Surfaces compromised accounts and cards before they can be fully exploited.
• Skimmer Detection: Identifies videos showing the installation or use of physical POS skimmers.
• Risk Mitigation: Helps organizations detect and prevent millions of dollars in potential losses.

Why is Flashpoint Video Search unique for brand and physical protection?

Flashpoint Video Search is unique for brand and physical protection because it provides visibility into a fast-growing medium that traditional text-based search tools miss. Physical security teams can use Flashpoint to detect threats against executives or facilities by monitoring for specific faces or locations in videos. Brand protection teams can identify insider threats by finding videos of stolen merchandise or compromised corporate servers that are being marketed for sale.

Protection Type	Flashpoint Application
Brand Protection	Finds videos of counterfeit products or brand impersonation attempts.
Executive Protection	Monitors for leaked PII or visual threats against high-profile personnel.
Physical Security	Identifies threats at specific physical locations, events, or points of interest.