Blogs

Blog

Why Effective CTEM Must be an Intelligence-Led Program

Continuous Threat Exposure Management (CTEM) is a continuous program and operational framework, not a single pre-boxed platform. Flashpoint believes that effective CTEM must be intelligence-led, using curated threat intelligence as the operational core to prioritize risk and turn exposure data into defensible decisions.

Continuous Threat Exposure Management (CTEM) is Not a Product

Since Gartner’s introduction of CTEM as a framework in 2022, cybersecurity vendors have engaged in a rapid “productization” race. This has led to inconsistent market definitions, with a variety of vendors from vulnerability scanners to Attack Surface Management (ASM) providers now claiming to be an “exposure management” solution.

The current approach to productizing CTEM is flawed. There is no such thing as a single “exposure management platform.” The enterprise reality is that most enterprises buy three or more products just to approximate what CTEM promises in theory. Even with these technologies, organizations still require heavy lifting with people, process, and custom integrations to actually make it work.

The Exposure Stack: When One Platform Becomes Three (or More)

A functional CTEM approach typically requires multiple platforms or tools, including: 

• Continuous Penetration/Exploitation Testing & Attack Path Analysis for continuous pentesting, attack path validation, and hands-on exposure validation.
• Vulnerability and Exposure Management for vulnerability scanning, exposure scoring, and asset risk views.
• Intelligence for deep, curated vulnerability, compromised credentials, card fraud, and other forms of intelligence that goes far beyond the scope of technology-based “management platforms”.

In some cases, organizations may also use an ASM vendor for shadow IT discovery, a CMDB for asset context, and ticketing integrations to drive remediation. This multi-platform model is the rule, not the exception. And that raises a hard truth: if you need three or more products, plus a dedicated team to implement CTEM, you need an intelligence-led CTEM program.

CTEM is an Operational Discipline, Not a Single Product

The narrative that CTEM can be packaged into a single product breaks down for three critical reasons:

1. CTEM is a Program, Not a Platform

You cannot buy a capability that requires full-stack asset visibility, contextualized threat actor data, real-world validation, and remediation orchestration from one tool. Each component spans a different domain of expertise and data. A vulnerability scanner, alone, cannot validate exploitability, a pentest service has a tough time scaling to daily monitoring, and generic threat intelligence feeds cannot provide critical business context.

However, CTEM requires orchestration of all these components in one operational loop. No single product delivers this comprehensively out of the box; this is why CTEM must be viewed as a continuous program, not a one-size-fits-all product.

2. Human Expertise is Irreplaceable

Vendors often advertise automation, however, key intelligence functions are still powered by and reliant on human analysis. Even with best-in-class AI tools in place, security teams are depending on human insights for:

• Triaging noisy CVE lists
• Cross-referencing exposure data with asset inventories
• Manually validating if risks are real
• Prioritizing based on threat intelligence and internal context
• Writing custom logic and integrations to bridge platforms together

In other words, exposure management today still relies on human insights and expertise. So while vendors advertise “automation and intelligence,” what they’re really delivering is a starting point. Ultimately, AI is a force multiplier for threat analysts, not a replacement.

3. Risk Without Intelligence Is Just Data

Most platforms treat exposure like a math problem. But real risk isn’t just CVSS (Common Vulnerability Scoring System) scores or asset counts, it requires answering critical, intelligence-based questions:

1. How likely is this vulnerability to be exploited, and what’s the impact if it is?
2. How likely is this misconfiguration to be exploited, and what is its impact?
3. How likely is this compromised credential to be used by a threat actor, and what is the potential impact?

These answers require intelligence, not just data. Best-in-class intelligence provides security teams with confirmed exploit activity in the wild, context around attacker usage in APT (Advanced Persistent Threat) campaigns, and detailed metadata for prioritization where CVSS fails. That is why Flashpoint intelligence is leveraged by over 800 organizations as the operational core of exposure management, turning exposure data into defensible decisions.

CTEM Productization vs. CTEM Reality

If your risk strategy requires continuous penetration and exploit testing, vulnerability management, threat intelligence, and manual prioritization and validation, you’re not buying CTEM; you’re building it. At Flashpoint, we’re helping organizations build CTEM the right way: driven by intelligence, and powered by integrations and AI.

The Intelligence-Led Future of Exposure Management

Flashpoint treats CTEM for what it really is, as a program that must be constructed intelligently, iteratively, and contextually.

That means:

• Using threat and vulnerability intelligence to drive what actually gets prioritized
• Treating scanners, ASM platforms, and pentesting as inputs, not outcomes
• Building processes where intelligence, context, and validation inform exposure decisions, not just ticket creation
• Investing in platform interconnectivity, not just feature checklists

Using Flashpoint’s intelligence collections, organizations can achieve intelligence-led exposure management, with threat and vulnerability intelligence working together to provide context and actionable insights in a continuous, prioritized loop. This empowers security teams to build and scale their own CTEM programs, which is the only realistic approach in a cybersecurity landscape where no single platform can do it all.

Achieve Elite Operation Control Over Your CTEM Program Using Flashpoint

If you’re evaluating exposure management tools, ask yourself:

• What happens when we find a critical vulnerability and how do we know it matters?
• Can this platform correlate attacker behavior with our asset landscape?
• Does it validate risk or just report it?
• How many other tools will we need to buy just to complete the picture?

The answers may surprise you. At Flashpoint, we’re helping organizations build CTEM the right way, driven by intelligence, powered by integration, and grounded in reality. Request a demo today and see how best-in-class intelligence is the key to achieving an effective CTEM program.

Request a demo today.

Blogs

Blog

Flashpoint’s Top 5 Predictions for the 2026 Threat Landscape

Flashpoint’s forward-looking threat insights for security and executive teams, provides the strategic foresight needed to prepare for the convergence of AI, identity, and physical security threats in 2026.

As the global threat landscape accelerates its transformation, 2026 marks an inflection point requiring defensive strategies to fundamentally shift. The volatility observed in 2025 has paved the way for an era soon to be defined by AI-weaponized autonomy, information-stealing malware, systemic instability of public vulnerability systems, and the complete convergence of digital and physical risk.

Flashpoint offers a unique window into these complexities, providing organizations with the foresight needed to navigate what lies ahead. Drawing from Flashpoint’s leading intelligence and primary source collections, we highlight five key trends shaping the 2026 threat landscape. These insights aim to help organizations not only understand what’s next but also build the resilience needed to withstand and adapt to emerging challenges.

Prediction 1: Agentic AI Threats Will Weaponize Autonomy, Forcing a New Defensive Standard

2026 will see continued evolution of AI threats, with future attacks centering on autonomy and integration. Across the deep and dark web, Flashpoint is observing threat actors move past experimentation and into operational use of illegal AI. 

As attackers train custom fraud-tuned LLMs (Large Language Models) and multilingual phishing tools directly on illicit data, these AI models will become more capable. The criminal intent shaping their misuse will also become more sophisticated. Additionally, 2026 will see a greater marketplace for paid jailbreaking communities and synthetic media kits for KYC (Know Your Customer) bypass.

These advancements are enabling criminals to move beyond simple tools and engage in scaled, autonomous fraud operations, leading to two major shifts:

1. Agentic AI is becoming the true flashpoint: Threat actors will be using agentic systems to automate reconnaissance, generate synthetic identities, and iterate on fraud playbooks in near real-time. In this SaaS ecosystem, AI will help attackers leverage subscription tiers and customer feedback loops at scale.
2. The attack surface will shift to focus on AI Integrations: Organizations are increasingly plugging LLMs into live data streams, internal tools, identity systems, and autonomous agents. This practice often lacks the same security vetting, access controls, and monitoring applied to other enterprise systems. As such, attackers will heavily target these integrations, such as APIs, plugins, and system connections, rather than the models themselves.

“The ubiquity of automation has dramatically increased attack tempo, leaving many security teams behind the curve. While automation can replace repetitive tasks across the enterprise, organizations must not make the critical mistake of substituting human judgement for AI at the intelligence level.

This is paramount because a critical threat in 2026 is Agentic AI autonomy weaponized against soft targets—API integrations and identity systems. The only winning defense will be human-led and AI-scaled, prioritizing purposeful use to keep organizations ahead of this exponential risk.”

Josh Lefkowitz, CEO at Flashpoint

These evolving AI threats will force a fundamental shift in defensive strategies. Defenders will have to shift to deploying systems around AI rather than trust them on their own.

Prediction 2: Identity Compromise via Infostealers Will Become the Foundation of Every Attack

Infostealers will become the entry point, the data broker, the reconnaissance layer, and the fuel for everything that comes after a cyberattack. This shift is already in motion and is accelerating rapidly: in just the first half of 2025, infostealers were responsible for 1.8 billion stolen credentials, an 800% spike from the start of the year. However, 2026 will redefine the malware’s role, making its most valuable output being access, rather than disruption.

Infostealers will become the upstream event that powers the rest of the attack chain. Identity and session data will be increasingly targeted, since it gives attackers immediate access into victim environments. Ransomware, fraud, data theft, and extortion will simply be downstream ways to monetize.

This upstream approach defines the new reality of the attack chain, which is already operational. Nearly every major stealer strain Flashpoint observes now exfiltrates the following:

• Autofill PII (personable identifiable information)
• Saved addresses
• Phone numbers
• Internal URLs
• Browsing history
• Cloud app tokens

An organization’s attack surface is no longer just composed of their own networks. It is the entire digital identity of their employees and partners. This new reality requires security teams to take a new approach. Instead of attempting to block attacks, they must proactively detect compromised credentials before they are weaponized. This will be the difference between reacting to a data breach and preventing one.

“The infostealer economy has fully industrialized the attack chain, making initial compromise a low-cost commodity. Multiple security incidents in 2025 tie back to credentials found in infostealer logs. This reality has underscored the critical importance of digital trust—specifically, verifying who can access what resources. For 2026, identity is the perimeter to watch, and security teams must proactively hunt for compromised credentials before they’re weaponized.”

Ian Gray, Vice President of Intelligence at Flashpoint

Prediction 3: CVE Volatility Will Force Redundancy in Vulnerability Intelligence

The temporary funding crisis at CVE in April 2025 and the subsequent CISA stopgap extension through March 2026 exposed the systemic fragility of a centralized vulnerability intelligence model. With the future of the CVE/NVD system hanging in the balance, 2026 will be defined by the urgent need for redundancy and diversification in vulnerability intelligence.

In today’s vulnerability intelligence ecosystem, nearly every organization’s vulnerability management framework relies on CVE and NVD—including its “alternatives” such as the EUVD (European Union Vulnerability Database). The CVE system has grown into a critical global cybersecurity utility, relied upon by nearly all vulnerability scanners, SIEM platforms, patch management tools, threat intelligence feeds, and compliance reports. A complete shutdown of CVE would result in a widespread loss of institutional infrastructure.

The next generation of security needs to be built on practices that are resilient, diversified, and intelligence-driven. It should be focused on providing insights that can be used to take action such as threat actor behavior, likelihood of exploitation in the wild, relevance to ransomware campaigns, and business context. Security teams will need to leverage a comprehensive source of vulnerability intelligence such as Flashpoint’s VulnDB that provides full coverage for CVE, while also cataloging more than 100,000 vulnerabilities missed by CVE and NVD.

Prediction 4: Executive Protection Will Remain a Critical Challenge as Cyber-Physical Threats Converge

The continued blurring of lines between cyber, physical, and geopolitical threats will elevate the risk to organizational leadership, turning executive protection into a holistic intelligence function in 2026. The rise of information warfare combined with physical world convergence means the threat to key personnel is no longer purely digital.

In the aftermath of the tragic December 2024 assassination of United Healthcare’s CEO, Flashpoint has seen the continued circulation and glorification of “wanted-style posters” of executives in extremist communities. Additionally, Flashpoint has seen nation-state actors participate, using espionage and influence to target high-value individuals.
Organizations must adopt an integrated approach that connects insights from threat actor chatter and a wealth of other OSINT sources. This fusion of intelligence is essential for applying frameworks to ensure the safety of leadership and key personnel.

Prediction 5: Extortion Shifts to Identity-Based Supply Chain Risk

2025 was marked by several large-scale extortion campaigns, demonstrating how the threat landscape is rapidly evolving. Ransomware operations have shifted into a straight extortion play. Flashpoint has observed a surge in new entrants to the ransomware market, accompanied by a decline in the quality and decorum of ransomware groups.

Furthermore, vishing campaigns attributed to “Scattered Spider” have highlighted weaknesses in identity, trust, and verification. Campaigns from “Scattered LAPSUS$ Hunters” have also exposed vulnerabilities in third-party integrations. These attacks culminated in extortion, showcasing that modern attacks will target trusted users and trusted applications for initial access, and will forgo ransomware in place of data access.

As this shift continues into 2026, threat actors will increasingly focus their efforts on exploiting human behavior and identity systems. Instead of attempting to spend resources on breaking network perimeters, attackers will instead socially engineer employees to gain access to corporate systems at scale. This change in TTPs will undoubtedly greatly increase supply chain risk, especially for third parties.

Charting a Path Through an Evolving Threat Landscape with Flashpoint Intelligence

These five predictions highlight the transformative trends shaping the future of cybersecurity and threat intelligence. Staying ahead of these challenges demands more than just reactive measures—it requires actionable intelligence, strategic foresight, and cross-sector collaboration. By embracing these principles and investing in proactive security strategies, organizations can not only mitigate risks but also seize opportunities to enhance their resilience.

As the threat landscape continues to rapidly evolve, staying informed and prepared are critical components of risk mitigation. With the right tools, insights, and partnerships, security teams can navigate the complexities ahead and safeguard what matters most.

Request a demo.

Blogs

Blog

G2 Recognizes Flashpoint as High-Performing ‘Leader’ in Enterprise Threat Intelligence

Breaking down Flashpoint’s rankings in G2’s 2023 fall reports, including customer testimonials

Flashpoint has earned multiple trust badges from G2’s Fall 2023 Reports, affirming our unwavering commitment to delivering timely, contextual intelligence to our clients so they can take rapid, decisive action to stop threats and reduce risk. Here are some highlights from G2’s reports.

‘Leader’ and ‘High Performer’

G2 awarded Flashpoint a “Leader Badge”—ranking us #1 in the Enterprise Americas Regional Grid for Threat Intelligence. Specifically, customers highlighted the value of Flashpoint’s finished intelligence reports, with 98 percent of customers emphasizing its utility.

‘The Platform itself is a great tool’

—CTI analyst on Ignite

94% ‘Likely to Recommend’

In G2’s Enterprise Relationship Index for Threat Intelligence, Flashpoint has the highest score for “Most Likely to Recommend,” with 94 percent of surveyed customers endorsing Flashpoint as an intelligence partner. 

Flashpoint also exceeded the index’s performance averages in all categories, including “Ease of Doing Business With” and “Quality of Support.” 

‘Flashpoint has been a great partner of ours for many years, and the trust we’ve built with their team of managers and analysts is excellent.‘

—Fraud Intelligence Lead, Fortune 500 Technology Company

Related reading: Flashpoint a Strong Performer in External Threat Intelligence Forrester Wave

Leader in Dark Web Monitoring

In G2’s Americas Regional Grid® Report, 99 percent of surveyed customers highlighted Flashpoint’s dark web monitoring capabilities.

Additionally, 90 percent of customers emphasized Flashpoint’s ticketing and RFI services, showcasing our commitment to the intersections between data, intelligence, and professional services support. 

‘Flashpoint offers the greatest amount of data regarding the criminal underground in relation to their peers. The data is well sorted, well presented, and easy to search.‘

— SVP, DFIR Investigations, Public Sector

‘An Excellent Intelligence Tool’

Hear from our customers by reading Flashpoint review on G2, or sign up for a free trial today to see how “great” threat intelligence can help your organization reduce risk and mitigate threats.

Request a demo today.

Blogs

Blog

The Flashpoint Firehose: 5 Questions With Michael Raypold, VP of Engineering

We sit down for a Q&A with Michael Raypold to discuss the launch of the Flashpoint Firehose, our new data-as-a-service solution

1. Tell me about the Flashpoint Firehose. What needs and challenges was it built to address?

Michael Raypold: The Flashpoint Firehose is a data-as-a-service solution that delivers a constant stream of data from various sources, ranging from social media platforms to messaging apps and illicit communities. It also includes numerous sources from APAC, Europe, the Middle East, and Africa—all vital data sources that are often underrepresented among other providers.

The Firehose delivers access to all ingested data from Flashpoint’s unique collections that data companies, federal systems integrators (FSIs), and large-scale national security teams need in order to build high-quality data and AI tools to enhance global situational awareness, generate timely intelligence, and advance national security initiatives.

With Firehose access, customers can pull key segments of Flashpoint data into their own infrastructure without needing to query our APIs. This unlocks the ability to train large language models or build machine learning models, enabling product development. This is especially important for many of our OEM partners.

2. Why is Flashpoint especially positioned to offer this type of solution?

Threat actors aren’t constrained by borders, and a diverse data set is imperative for organizations working in the cyber and physical security domains. Because of this, Flashpoint has dedicated the last 13 years to building out its collections capabilities and in-house analyst team to deliver actionable intelligence from a wide range of publicly and commercially available information data sources. As a result, Flashpoint has become the industry leader in delivering solutions for cyber threat intelligence, vulnerability management, physical security intelligence, and national security teams.

3. What are some of the unique capabilities of the Firehose?

The Firehose excels in the following primary categories:

1. Speed: Once the data is ingested by the Flashpoint Firehose, it is delivered to the customer in real-time or near-real-time. This is especially important for customers building products where speed is paramount, such as an alerting dashboard.

2. Data: Flashpoint focuses heavily on the variety, breadth, and depth of its data, which is incredibly important for our customers who require comprehensive coverage of the information landscape.

3. Flexibility: The Firehose is designed to enable users to manipulate the data according to their specific needs.

To ease adoption, Flashpoint has also enriched all of the Firehose content with geospatial inference and language detection, making it easier for users to draw actionable insights and pivot off of Flashpoint’s unique selectors.

4. Tell me more about the ML enrichments.

Once collected and structured, the data undergoes enrichment through named entity recognition and machine learning, providing geospatial insight and language detection, offering customers additional ways to filter and query the data while delivering immediate value. This data can then integrate seamlessly into custom products and be indexed according to the customer’s requirements.

5. As an engineer yourself, what excites you the most about the Firehose?

When building high-quality intelligence products, engineers are often limited by the breadth, depth, and availability of the data they can query or make actionable for their customers. This problem is exacerbated when they have to make API queries to third-party providers. 

The ability to ingest Flashpoint data in real time and have end-to-end control over the storage, enrichment, and querying of that data enables really exciting product opportunities. The Firehose allows engineers to ingest data into their own infrastructure and enable a crisper product experience.

The ability to build a notification or alerting pipeline off of a data stream is one possibility that’s unlocked with a Firehose versus a REST API. Others will find that the Firehose is uniquely positioned for anomaly detection, dashboarding, data visualization, training large language models, or extending internal and proprietary data sets to craft a truly differentiated experience.

We’re innovating entirely with our partners in mind, to fulfill their data requirements. The Flashpoint Firehose was built to serve as a force multiplier for their data-driven products, enabling them to realize their visions and value faster.

Learn more about the Flashpoint Firehose here.

Request a demo today.

Blogs

Blog

Why We Built Flashpoint Ignite: Unity, Power, and Performance

Flashpoint’s Chief Product and Engineering Officer, Patrick Gardner, introduces Flashpoint Ignite—our new platform to accelerate cross-functional threat detection and risk mitigation for CTI, Vulnerability, National Security, and Physical Security teams

Flashpoint has long been known for its industry-leading data collection and finished intelligence. After two major acquisitions in 2022, we have powerful far-reaching visibility with more technology than ever, which presents us with an amazing challenge—how do we put these components together in a way that unlocks even more value for our customers?

Our answer: Ignite—Flashpoint’s brand new, team-tailored, lightning-fast intelligence platform.

What is the Flashpoint Ignite Intelligence Platform?

The Flashpoint Ignite platform is a technology ecosystem that delivers tailored intelligence across multiple security functions in a combined workspace. It enables security teams to connect and remediate risk faster with access to Flashpoint’s extensive intelligence, along with analytical tools to rapidly find relevant data as well as the ability to request custom intelligence support in just a few clicks. 

Ignite is the home of our new Cyber Threat Intelligence, Physical Security Intelligence, Vulnerability Management, and National Security Intelligence solutions, and it provides a unified experience across the organization. With a holistic view of risk in one place, security and intelligence practitioners can finally close the gap between data, intelligence, and action.

“In an overwhelming information landscape, we are doing everything possible to make our customers’ jobs easier.”

Patrick Gardner

Why Did We Build the Flashpoint Ignite Platform?

When I joined Flashpoint in September 2022, I felt like a kid in a candy store. We have an incredible amount of information and capabilities. Our strategy is to make it easy and fast to surface that value for our customers to tackle various challenges. We built Ignite to support this goal and to help our customers solve their challenges more effectively. 

The main pillars we aim to address with the Flashpoint Ignite platform are:

• Improving user experience by making it intuitive, faster, customizable, and easier to find relevant information.

• Incorporating custom intelligence requests into the platform to allow users to manage and track their reports in a single unified location.

• Integrating all of our data so users can see threats end-to-end.

Key Ignite Features

Each solution under the Ignite platform has its own set of powerful features specially designed to support different teams’ intel missions, each of which contribute to an organization’s overarching security objective to protect assets, infrastructure, and stakeholders from cyber and physical threats. 

The real power of Ignite is how we bring these capabilities together with common features across all solutions:

• Universal Search: Ignite allows users to easily and quickly navigate through the vast landscape of collections and intelligence to find the information they need across text, video, conversations, and images with a single search across all data.  
• Alerting: Ignite enables users to create intuitive and highly customizable alerts directly from their searches to inform them when pertinent information is uncovered.
• Reports: Ignite helps teams inform decision-making and prioritize efforts to protect their organizations with a sleek news-style finished intelligence experience that makes it easy to find the content most relevant to your organization’s risk profile and mitigation strategy.

How Ignite Powers Results

In an overwhelming information landscape, we are doing everything possible to make our customers’ jobs easier. These are the main outcomes we aim to deliver with Ignite: 

Enabling teams to achieve more with an integrated Flashpoint experience

• Ignite delivers a range of solutions to support various security teams while providing the extensibility to integrate and interoperate with other solutions. Teams can easily obtain the information they need to move information forward and remediate risk faster. 

Providing dependable intelligence for everyone

• We gather data from all different corners of the internet, cut through the noise, and find the answers our customers need to do their jobs faster. Whether they need visibility into the deep and dark web, OSINT/surface web, vulnerabilities, breach data, or geospatial intelligence–our finished intelligence reports and raw collections are right at our users’ fingertips.

Closing the gap between data, intelligence, and action

• Users can quickly assess their data across all products, streamline workflows, adapt, and take decisive action. Ignite connects multiple tools, so whether our customers are deep in investigative work or consuming reports to stay on top of trends, they can stay ahead of the changing threat landscape.

What’s Next?

With all the strengths Flashpoint has, there’s so much opportunity and we’ve only scratched the surface. Ignite provides a highly flexible and robust technology layer for us to build lightning-fast, easily searchable solutions for teams across the security organization. 

In the future, customers can expect better integrations, more powerful enrichments, increased data correlation, new visualizations, and more relevant information automatically recommended through situational awareness, alleviating the need to spend excess time and resources seeking it out.

Frequently Asked Questions (FAQs)

What is Flashpoint Ignite and why should my organization use it?

Flashpoint Ignite is a unified intelligence platform that brings together cyber threat intelligence, physical security, vulnerability management, and national security data into one workspace. Your organization should use it to eliminate data silos and accelerate the time it takes to detect and remediate risks. By consolidating all of Flashpoint’s industry-leading data into a single, lightning-fast ecosystem, Ignite allows your teams to see threats from end to end.

Flashpoint Ignite Solution	Team Benefit
Cyber Threat Intelligence	Accelerates investigations into dark web actors and malware.
Physical Security Intelligence	Provides situational awareness for executives and global facilities.
Vulnerability Management	Prioritizes patching based on real-world exploitability data.

How does Flashpoint Universal Search improve analyst efficiency?

Flashpoint Universal Search improves efficiency by allowing analysts to query the platform’s vast collections of text, video, images, and technical data with a single search. Instead of toggling between different tools or datasets, Universal Search within Flashpoint Ignite surfaces all relevant information instantly. This “one-stop” search capability acts as a force multiplier, giving analysts back the time and energy they used to spend on manual data aggregation.

• Unified Results: See dark web chatter, technical indicators, and media in one view.
• Format Flexibility: Search for keywords within videos and images using OCR and logo detection.
• Speed-to-Insight: Reduces the steps required to validate a threat and move toward action.

Why is the unified experience in Flashpoint Ignite better than using separate tools?

The unified experience in Flashpoint Ignite is better because it closes the dangerous gap between data, intelligence, and action. Using separate tools often leads to missed correlations and slower response times. In Flashpoint Ignite, security and intelligence practitioners can view cyber and physical risks side-by-side, ensuring that every decision is backed by a holistic understanding of the organization’s risk profile.

Traditional Multi-Tool Approach	Flashpoint Ignite Unified Experience
Fragmented Data	Fully integrated data across all security functions.
Slower Triage	Accelerated remediation through cross-functional workflows.
Higher Complexity	Simplified news-style reporting and intuitive custom alerts.

Request a demo today.

Blogs

Blog

The Risk-Reducing Power of Flashpoint Video Search

An essential investigative component, Flashpoint’s industry-first video search technology surfaces logos, text, explicit content, and other critical intelligence for CTI, Fraud, Brand Protection, and Physical Security teams

Video as Essential Threat Intelligence

When advertising and selling their services, or boasting about their exploits, threat actors will often post media, including video, to illicit communities that serve as proof points for potential buyers and partners.

They showcase sensitive information and stolen goods, including: stolen identities, compromised bank accounts, checks, and stolen credit cards; gift cards and receipts; fake, unlicensed merchandise; ATM skimmers and shimmers, guns and drugs, exploit code, RDP access, brand impersonation, physical security threats, and much more.

Now, video use amongst threat actors is on the rise, as media-rich, mobile-first communication is becoming a primary mode of communication in illicit communities. Gaining visibility into this threat landscape is essential intelligence to CTI, Fraud, Brand Protection, and Physical Security teams, among other practitioners whose job it is to protect against exposure to fraud, corporate brand abuse, and acts of violence: 

Even better is having a way to search this media across text, images, and video in order to identify potential threats. Flashpoint offers all three—and our new video search analysis is a unique offering on the market.

What is Flashpoint Video Search Technology?

Building on the success of our OCR capability for images, security teams can now surface threats in videos posted by threat actors using object detection, logo detection, text extraction, and explicit content detection directly within the Flashpoint Intelligence Platform.

Security teams across various industries in public and private sectors have realized the value of searching for, and being alerted on, images of company assets that pop up on open-source and darknet communities. Flashpoint’s video search analysis expands the scope of coverage, offering additional insights into a fast-growing medium used by threat actors.

What Can It Identify?

Video search analysis gives teams the ability to search for and generate keyword specific alerts for text, logos, and organizational assets inside videos across Flashpoint intelligence collections. Flashpoint’s new video search analysis helps to identify: 

• Labels and objects, including products, locations, activities, and animal species
• Logos, including a library of more than 100,000 brand-specific media
• Text, including the detection and extraction of text within an input video using OCR
• Explicit content, including adult content in videos, which is generally defined as inappropriate for people under the age of 18

What Can Flashpoint Video Search Identify?

Video search analysis equips security teams with the additional tools and intelligence they need in their missions of preventing fraud and protecting their organization.

Financial Fraud

Search for a bank or institution name to discover videos with that particular logo or text in them. Locate a threat actor boasting about ATM access, logos or text on a check or receipts, or of a physical brick and mortar building. Video search analysis can be used to uncover instances of threat actors engaging in using ATMs to extract cash, duplicating false checks, credit card fraud, and POS skimmers. 

Additionally, Flashpoint financial services customers have found countless instances of potentially fraudulent accounts, checks, and cards using image OCR—and our new video search analysis functionality will only enhance and increase the ability to prevent financial fraud. One Flashpoint financial services customer detected more than $4M in illicitly marketed assets, including checks and compromised accounts, using our OCR capabilities.

Physical Security 

Enhance executive protection by monitoring for specific personally identifiable information (PII) related to employees, executives, and organizations. With this, physical security teams can work to prevent acts of violence and crimes or threats at points of interest, events, or physical locations. 

Brand Protection

Monitor for an organization’s brand in videos shared by illicit actors, including the ability to identify insider threats via videos of compromised web servers, compromised customer accounts, and stolen merchandise. 

Access Flashpoint Video Search Today

Learn more about how Flashpoint’s industry-first video search technology can help your teams surface logos, text, explicit content, and other critical intelligence.

Frequently Asked Questions (FAQs)

What is Flashpoint Video Search and how does it help investigators?

Flashpoint Video Search is an industry-first technology within the Flashpoint Intelligence Platform that allows users to search for specific objects, text, and logos inside video files. It helps investigators by surfacing critical intelligence from videos posted in illicit communities, such as threat actors boasting about stolen bank accounts, showing off illegal weapons, or demonstrating how to use POS skimmers.

Flashpoint Video Search Capability	Investigative Benefit
Logo Detection	Identifies a library of 100,000+ brand logos inside video frames.
Text Extraction (OCR)	Reads and pulls text, such as names on checks or credit cards, from video.
Object Labeling	Detects physical items like ATM skimmers, guns, or specific products.

How does Flashpoint Video Search assist in preventing financial fraud?

Flashpoint Video Search assists in preventing financial fraud by allowing banks and institutions to scan for their brand names and assets in videos shared on the dark web. Fraud teams can use Flashpoint to find threat actors showcasing “proof” of their exploits, such as videos of cash being extracted from compromised ATMs or close-ups of stolen checks and credit cards, enabling the bank to cancel those assets immediately.

• Asset Recovery: Surfaces compromised accounts and cards before they can be fully exploited.
• Skimmer Detection: Identifies videos showing the installation or use of physical POS skimmers.
• Risk Mitigation: Helps organizations detect and prevent millions of dollars in potential losses.

Why is Flashpoint Video Search unique for brand and physical protection?

Flashpoint Video Search is unique for brand and physical protection because it provides visibility into a fast-growing medium that traditional text-based search tools miss. Physical security teams can use Flashpoint to detect threats against executives or facilities by monitoring for specific faces or locations in videos. Brand protection teams can identify insider threats by finding videos of stolen merchandise or compromised corporate servers that are being marketed for sale.

Protection Type	Flashpoint Application
Brand Protection	Finds videos of counterfeit products or brand impersonation attempts.
Executive Protection	Monitors for leaked PII or visual threats against high-profile personnel.
Physical Security	Identifies threats at specific physical locations, events, or points of interest.

Request a demo today.

Blogs

Blog

Risk Intelligence Index: Cyber Threat Landscape by the Numbers

Flashpoint’s monthly look at the cyber risk ecosystem affecting organizations around the world, including intelligence, news, data, and analysis about ransomware, vulnerabilities, insider threats, and takedowns of illicit forums and shops.

Ransomware

Flashpoint’s latest ransomware infographic paints a sobering picture of the evolving threat landscape, as cybercriminals employ increasingly sophisticated—and effective—tactics. Last month, our analysts observed a total of 397 ransomware attacks.

Key takeaways for the state of ransomware

• Organizations in the United States bore the brunt of ransomware attacks, accounting for a staggering 211 incidents—a 66 percent increase compared to last month.
• The top three industries targeted by ransomware were Professional Services, Internet Software & Services, and Construction & Engineering.
• Clop ransomware has emerged as one of the most active ransomware groups, securing the second spot in March’s top 10 ranking. Last month, Clop garnered attention by exploiting a remote code execution vulnerability—allegedly enabling them to acquire data from over 100 organizations, although they only disclosed a few victim names on their blog.

Vulnerabilities

According to our intelligence, 2,245 new vulnerabilities were reported in March, with 379 of them being missed by the Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD).

Key takeaways for the state of vulnerability intelligence

• Approximately 34 percent of March’s disclosed vulnerabilities are rated as high-to-critical in severity, which if exploited, could pose a significant risk to an organization’s security posture.
• Over 78 percent of March’s vulnerabilities are remotely exploitable, meaning that if threat actors are able to leverage these issues, they can execute malicious code no matter where the device is located.
• Nearly 29 percent of March’s vulnerabilities already have a documented public exploit, which drastically lessens the difficulty to exploit.
• Vulnerability Management teams can potentially lessen workloads by nearly 88 percent by first focusing on actionable, high severity vulnerabilities—i.e., vulnerabilities that are remotely exploitable, that have a public exploit, and a viable solution; 253 of March’s vulnerabilities meet this criteria.

Insider Threat

The tactic of recruiting insiders has become immensely popular amongst threat actors aiming to breach systems and/or commit ransomware attacks.

In March, our analysts collected 5,586 posts advertising insider services—both from threat actors seeking insiders and malicious employees offering their services. Of those, 1,127 were unique posts from individuals in illicit and underground communities.

Key takeaways for the state of insider threat intelligence

• In March, Flashpoint tracked 5,586 posts related to insider threats activity—both from threat actors attempting to solicit insider-facilitated access and from disgruntled employees offering their services. Of the total, 1,127 were unique postings.

• At this time, the Telecom industry is the most targeted sector, followed by Financial and Retail.

• Looking into the state of insider threats further, Flashpoint found that the majority of insider threat related postings originated from inside the organization with malicious insiders offering their services. Most of this activity came from the Telecom sector. 

Takedowns

In March 2023, there were numerous takedowns, voluntary shutdowns, and arrests affecting ransomware, markets, account shops, card shops, and individual cybercriminals. Here are the high-profile takedowns.

Breach Forums

On March 21, 2023, mid-tier hacking forum Breach Forums was shut down following the arrest of its administrator, Conor Brian Fitzpatrick (aka “pompompurin”), six days prior.

Read the court doc here.

Worldwiredlabs

On March 3, a US Magistrate Judge issued a seizure warrant for Worldwiredlabs[.]com, a domain used by cybercriminals to sell malware, including remote access trojan (RAT) “NetWire,” which is capable of targeting and infecting major computer operating systems.

On March 7, an international law enforcement effort led to the seizure of Worldwiredlabs. The FBI had begun its investigation in 2020, and uncovered that it was the only known online distributor of NetWire.

Read the court doc here.

Get best-in-class intel

The following data is derived from the Flashpoint Intelligence Platform and VulnDB, the most comprehensive and timely source of vulnerability intelligence available. Sign up for a free trial today.

Request a demo today.

Blogs

Blog

Flashpoint in 2023: A Note From Our CEO

How Flashpoint will improve, innovate, and inspire in 2023

Harnessing the OSINT revolution

To me, 2022 was the year of OSINT, a time when open-source intelligence (finally) got its time in the sun. This is due in large part to Russia’s full-scale invasion of Ukraine—a hybrid war nearing the one-year mark that’s being waged across cyber and physical battlefields. In fact, the war between Russia and Ukraine has become the poster child for how truly essential and impactful OSINT can be, especially during a modern military engagement.

To be clear, Ukrainians and organizations active in Ukraine face the most acute risks. But this war is also actively impacting even those who are not physically present in Ukraine, including commercial entities and world governments. For these organizations, gaining reliable, timely, and actionable intelligence is a constant test—one that Flashpoint is helping hundreds of clients tackle daily. 

OSINT has long been a mission-critical investigatory tool in the security and intelligence community, especially in the public sector, and 2022 proved that out. Malware, insider threats, data breaches, financial and cryptocurrency fraud, violent extremism, social engineering schemes, and ransomware continued to plague organizations of all sizes across the public and private sectors. 

Strengthened by our 2022 acquisitions of Risk Based Security and Echosec Systems, Flashpoint is now the commercial leader in open-source intelligence, which CIA Deputy Director for Digital Innovation Jennifer Ewbank calls “one of our richest sources of insight and our INT of first resort.” 

Today, more than 730 customers globally rely on our intelligence, expertise, and technology—leaning on Flashpoint to form a bulwark between their assets and risk. In 2023, Flashpoint will continue to invest in OSINT’s revolutionary effect in order to continue to deliver on our mission. Here’s how.

Roadmap 2023

In the last 12 months we’ve delivered new products, features, and functionalities to our clients that make our data and intelligence even more actionable. This includes: 

• Flashpoint Automate to help create automatic workflows 
• A first-of-its-kind ransomware prediction model for vulnerabilities 
• Flashpoint Monitor, a new alerting and analysis capability that helps intel analysts quickly and easily transform open-source data into actionable intelligence 
• Managed Attribution, our virtual machine solution to empower our users to access OSINT securely and anonymously.

In 2023, Flashpoint will deliver products that make it even easier for security teams of all sizes and sophistication levels to leverage OSINT, as well as our complete suite of risk intelligence tools, to find and stop threats quickly. To accomplish this, our roadmap is focused, in part, on putting all the right OSINT into a single platform that empowers different security teams to take the right actions tailored to their mission to reduce risk. 

More than simply supporting a single team, Flashpoint is able to empower teams across organizations to reduce their overall holistic risk across both the cyber and physical domains. Security programs that take holistic perspectives of addressing risk will be best prepared to prevent and mitigate an expanding threat landscape. 

UX improvements

In the year ahead, we’ll be releasing a redesign of our entire user experience with more intuitive navigation, situational awareness to guide teams to the most important intelligence to discover threats quickly, and blazing fast search rebuilt from the ground up with proprietary data science models to deliver the most relevant results up front. 

Whether in the commercial sector on a Cyber Threat Intelligence (CTI), Vulnerability Management, or Physical Security team or in the public sector in Defense, Law Enforcement, or National Security, our upcoming experience is going to save teams and organizations time and cost in detecting and mitigating threats. 

Intelligence classes

Furthermore, in order to make our intelligence more accessible and easily discoverable by teams, Flashpoint will be releasing mission-based intelligence classes. The dizzying array of intelligence and data sources can make it difficult to find the most relevant intelligence. 

Today, teams need to know which data sources to search in combination with what is relevant for their specific security mission, ranging from vulnerabilities, financial fraud, threat actors, and many more. Flashpoint is changing that with clearly defined intelligence classes that are tied directly to mission to help find the relevant intelligence quickly and easily.

OSINT’s continued impact

In addition to our products and solutions supporting the private sector, we’re also very proud that our OSINT is supporting public sector missions as well. Whether Defense, Law Enforcement, or National Security, Flashpoint’s data and intelligence have been applied to save lives and reduce risk, reflecting the profoundly positive impact OSINT can make in our world. 

In addition, different security teams leverage the same OSINT data in different ways, based on their missions, and Flashpoint will help connect the dots for teams to collaborate in reducing risk benefiting the entire organization. OSINT’s impact crosses teams, industries, and the private and public sectors. As threat intelligence continues to evolve, OSINT has become a must-have in informing and assessing risk. 

Noted Ewbank, “When you think about the future of the intelligence business…you should first think about open source.” 

To a safe and successful year ahead

All of these upcoming improvements highlight that in 2023, Flashpoint’s risk intelligence platform will be the essential tool for security teams of all sizes and maturities who recognize that intelligence works best in a multi-team approach to reduce risk holistically. 

We are excited to roll out these improvements throughout the year to help our customers protect their employees, customers, assets, and stakeholders in the face of the threats we will undoubtedly face in 2023. While certainly there will be threats to face in the new year, I’m optimistic that as a security community, we will again rise to the challenge, and that 2023 will be a successful year for the good guys. 

In the end, this is the name of the game: leveraging intelligence to close gaps in an organization’s risk profile. This was, as ever, Flashpoint’s focus in 2022. And it will continue to be our focus in 2023. 

Thank you to our Flashpoint customers, partners, and team for a successful 2022—we are proud to partner with our customers to help them and the broader community reduce their risk. And, of course, I’d like to wish the entire community a very happy, healthy, and safe new year!

Request a demo today.

Blogs

Blog

Why We Acquired Echosec Systems: The OSINT Revolution

Flashpoint CEO Josh Lefkowitz on the Echosec acquisition and the proven, foundational importance of open source intelligence

It’s our mission as intelligence providers to some of the world’s most discerning clients to help them stay ahead of the threats that could impede their focus on protecting their people, places, and assets everywhere. 

Today thus marks a key moment in our evolution as a company. I’m delighted about our acquisition of Echosec Systems, whose team and technology are world class and whose intelligence will help us continue to help companies reduce risk holistically across teams. 

Here’s why I’m so excited to be able to bring Echosec’s open-source, social media, and geospatial intelligence to a wider audience, and where we go from here.

The Importance of OSINT

I began my career in the wake of 9/11 analyzing the activities of terrorist groups to support numerous national security investigations and prosecutions. My experiences in this domain spurred the recognition that open source intelligence (OSINT) could be an invaluable counterterrorism tool. When we realized that OSINT in the modern era couldn’t be done without automating data collection and analytics at scale, Flashpoint was born.

The online spaces where threat actors congregate and operate have evolved dramatically since the early 2000s and now include illicit communities, criminal marketplaces, paste sites, and foreign-language forums across the deep and dark web. Furthermore, there’s much intelligence to be gleaned from publicly available information (PAI) and OSINT derived from social media, including geospatial data, social sentiment, and other real-time information that can support mission requirements for national security, public safety, and commercial security teams.

Today, OSINT is a proven and foundational element to the intelligence community. 

As Jennifer Ewbank, Deputy Director for Digital Innovation at the CIA, said recently: “Many questions that once had to be answered by more secretive intelligence collection are now answered with a few clicks on a mobile device.” 

She added, “OSINT is the INT of first resort, informing every aspect of the intelligence community’s mission. When you think about the future of the intelligence business…you should first think about open source.”

And the most dynamic and impactful intelligence partners, like Flashpoint, are helping organizations leverage technology to harness OSINT at scale, organize it, classify it, make sense of it, and understand when action is warranted.

Why Echosec

This is where Echosec is a leader in giving users the ability to leverage real-time OSINT to drive on-the-ground insights and action. Complemented by Flashpoint’s own OSINT and unique collections, this key acquisition continues our evolution as the leading provider of actionable intelligence, supporting cyber and physical security missions around the world.

Data, Platform, and Compliance

Echosec has built an extraordinarily intuitive and highly user-friendly platform that is helping some of the most demanding and discerning customers address a broad array of threats globally. 

Echosec maintains broad coverage across critical social media platforms worldwide. Their OSINT provides security teams across the public and private sector localized situational awareness in faraway places, helping them better assess geopolitical risk, keep executives from harm, protect populations and places, and respond to crises in an informed and efficient manner.

In addition to best-in-class social media collections, Echosec has maintained a focus on ensuring compliance with all social media platforms. The company’s respect for privacy and security of data subjects was a key factor in our decision to acquire them and falls in line with our own policies. Both Flashpoint and Echosec share an ethos around the importance of ethical and compliant data access to be a trusted intelligence partner. 

Mission and Team

Additionally, the Echosec and Flashpoint missions are very well aligned—notably overlapping around the theme of protection. Our mission alignment is incredibly important as we move forward with the merged companies, as it will ensure continuity and clarity to both organizations’ current and future clients.

Our mission will continue to drive the choices we make as a company so that we can continue to help organizations protect what they value and cherish most, and to do our part to make the world a safer place.

Echosec’s team is a mighty one, and what they’ve built is incredible. I am so excited to bring on a team as talented as they are and whose culture- and mission-driven  values align so well with ours. 

The Future is Now

Buoyed by Echosec’s data, platform, and approach to compliance, coupled with our mutual and value/team alignment, Flashpoint is geared up for huge successes in the coming months and years.

Following on the heels of our Risk Based Security acquisition in January, the integration of Echosec further enables Flashpoint to empower CTI, vulnerability management, and corporate security teams to work together to detect, prioritize, and mitigate the threats across their organization to reduce overall risk more comprehensively. 

In the weeks to come, as we integrate Echosec’s data and technology into the Flashpoint Suite, we can’t wait to share with our customer and peers our extended capabilities, delivering the world’s most robust combination of data, analytics, and automation across a wide range of security use cases.

Frequently Asked Questions (FAQs)

Why did Flashpoint acquire Echosec and how does it improve the platform?

Flashpoint acquired Echosec to integrate world-class OSINT and social media intelligence into its existing threat data ecosystem. This improves the platform by providing a unified view of both cyber and physical risks. Flashpoint users can now monitor dark web forums and real-time social media activity in a single workspace, allowing them to detect threats against their personnel and facilities that traditional cyber intelligence might miss.

Flashpoint Feature	Acquisition Benefit
Location-Based Search	Allows users to monitor security events at specific GPS coordinates.
Broad OSINT Access	Connects dark web chatter with surface web social media trends.
Unified Dashboard	Streamlines investigations by housing CTI and PSI in one interface.

How does the addition of Echosec technology enhance executive protection?

The addition of Echosec technology enhances executive protection by allowing security teams to monitor for doxing, threats, and travel risks on social media. Flashpoint can now identify when a leader’s travel plans are being discussed in illicit forums and then use Echosec’s geofencing to monitor the safety of the specific hotel or event venue they are visiting. This provides a digital-to-physical protective shield for high-profile personnel.

• Real-Time Monitoring: Alerts teams to social media posts targeting specific executives.
• Geofencing: Tracks activity around an executive’s current location or destination.
• Sentiment Analysis: Identifies rising hostility or planned protests before they reach a leader’s location.

Why is Flashpoint’s “360-degree view of risk” vital for modern enterprises?

Flashpoint’s 360-degree view of risk is vital because modern threats are no longer strictly digital or physical. A threat actor might use social media to coordinate a physical breach of a data center or recruit an insider for a cyberattack. By combining Echosec’s social data with Flashpoint’s deep web collections, enterprises can identify these cross-functional threats in their early stages and mitigate them before they impact the business.

Threat Type	Flashpoint Integrated Response
Physical Security	Uses geofencing to detect on-the-ground threats to corporate offices.
Brand Protection	Tracks both dark web counterfeit sales and social media brand abuse.
Supply Chain	Monitors logistics hubs for both cyber vulnerabilities and physical disruptions.

Request a demo today.