Table Of Contents

Table of Contents

How EASM Extends Vulnerability Prioritization to Your Full Environment

Why This Matters More in Regulated Industries

Discovery and Prioritization, Built Into One Platform

Frequently Asked Questions

More

subscribe to our newsletter

Security teams have more vulnerability data at their disposal than ever. But even the best intelligence has limited value if teams can’t determine where those vulnerabilities exist within their own environment.

For many organizations, that visibility remains a challenge. Asset inventories, scanners, and ticketing systems provide valuable information, but connecting those insights with real-world exploit activity isn’t always straightforward. And as environments evolve, undocumented assets, forgotten infrastructure, and newly exposed systems can introduce risks that traditional inventories may miss.

Flashpoint External Attack Surface Management (EASM) helps close that gap by connecting continuous discovery of internet-facing assets with Flashpoint’s threat-informed Vulnerability Intelligence. With coverage of more than 480,000 vulnerabilities, including over 105,000 not found in NVD or CVE, Flashpoint provides context on active exploitation, exploit maturity, and ransomware risk through its patented Ransomware Risk model. Together, these capabilities help teams identify which exposures warrant the most immediate attention.

What is EASM? External Attack Surface Management (EASM) is the continuous discovery and monitoring of an organization’s internet-facing assets, including domains, subdomains, IPs, and infrastructure that isn’t formally tracked. It gives security teams visibility into what’s exposed to the internet, whether or not that infrastructure was deliberately set up or documented.

How EASM Extends Vulnerability Prioritization to Your Full Environment

EASM continuously discovers internet-facing assets associated with an organization, including domains, subdomains, IP addresses, and infrastructure that may not appear in existing inventories. This could include a subsidiary’s infrastructure following an acquisition, a forgotten staging environment, or a cloud instance that remains active long after a project ends.

With Flashpoint EASM, discovered assets enter a triage queue organized by relevance, helping teams focus on assets that warrant further investigation. Once ownership is confirmed, Flashpoint maps those assets against its Vulnerability Intelligence to identify vulnerabilities associated with the software versions running on them.

Findings are prioritized using Flashpoint KEV, EPSS, and Ransomware Risk scores. Asset-level details also show the products and versions responsible for identified exposures, along with potentially high-risk open ports such as RDP and SSH. This gives teams the context they need to assess risk and determine where remediation should begin.

Example Scenario

Consider a development team that deploys a staging server running an outdated web framework. The project ends, but the server remains online and is never added to the organization’s asset inventory.

Flashpoint EASM discovers the server and shows how it connects to the organization’s infrastructure. Once the team confirms ownership, Flashpoint Vulnerability Intelligence identifies an actively exploited CVE affecting the framework version.

The team can now investigate an exposure that might otherwise have gone unnoticed and prioritize remediation based on evidence of active exploitation.

Why This Matters More in Regulated Industries

For organizations in heavily regulated industries such as financial services and healthcare, incomplete asset visibility can introduce additional compliance and security risks. Requirements under frameworks and regulations such as GLBA and HIPAA make maintaining appropriate safeguards especially important. An unknown, internet-facing asset with an exploitable vulnerability can create exposure regardless of whether it appears in the organization’s CMDB.

Mergers and acquisitions can complicate this further. Acquired organizations bring infrastructure that security teams may have limited visibility into, including assets that have not yet been incorporated into existing monitoring processes.

Continuous external asset discovery helps teams identify and assess that infrastructure earlier, reducing reliance on periodic audits or manual inventory updates to uncover potential exposures.

Discovery and Prioritization, Built Into One Platform

When attack surface discovery and vulnerability intelligence operate in separate systems, security teams may need to manually correlate asset inventories with vulnerability findings. That process becomes increasingly difficult as infrastructure changes and new vulnerabilities emerge.

Flashpoint brings these capabilities together in one platform, an approach we call attack surface intelligence. Newly discovered assets can be evaluated against Flashpoint’s Vulnerability Intelligence, giving teams access to threat-informed prioritization within the same workflow.

For teams already using Flashpoint Vulnerability Intelligence, EASM can be added as a module within the existing Ignite platform, with no separate console to manage. Contact your account team to learn more about adding EASM to your deployment. New to Flashpoint? Schedule a demo to explore how Vulnerability Intelligence and EASM work together to help your team identify and prioritize external exposures.

Frequently Asked Questions

How is EASM different from a vulnerability scanner? 

Traditional vulnerability scanners scan assets you already know about and tell them to check, typically from inside the network perimeter. EASM continuously discovers internet-facing assets from the outside, including unknown infrastructure like forgotten test environments and acquired systems, then enriches them with vulnerability intelligence beyond public sources like NVD and CVE. The two are complementary: scanners provide depth on known internal assets, while EASM extends that visibility to what’s exposed externally.

Can EASM help identify compound risk on a single asset? 

Yes. The Vulnerable Assets view surfaces how many vulnerabilities are tied to a given asset, so teams can quickly spot assets carrying disproportionate risk and prioritize accordingly, rather than treating every finding as an isolated issue.

If we’re already running Flashpoint Vulnerability Intelligence, do we need a new implementation to add EASM? 

No. EASM is a module inside the platform you’re already using. It appears inside the same Ignite workflows your team relies on today, with no separate console or parallel rollout required.

How is EASM priced?

EASM is priced based on company size rather than asset count or seats, so costs are predictable and don’t scale up just because the attack surface grows.

The post The Missing Layer in Vulnerability Prioritization: Full Visibility Into Your Attack Surface appeared first on Flashpoint.

By Aparna Ash Himmatramka

A developer using an AI assistant can ship a feature in an afternoon. In many organizations, the security review for that feature can still take a week.

Believe it or not, most AppSec programs are still built this way. BSIMM16, which studied 111 organizations, found security feature review in 80.2% of them. Those reviews made sense when teams shipped quarterly. Today they’re the bottleneck. What this means is that teams only review their crown jewels, and everything else goes unexamined.

Having worked in the AppSec field for more than 8 years now, I see this problem repeated over and over again. Until I realized it’s not a technical problem, it’s a gap of how we measure success for these programs.

The usual response is to make reviews faster: better triage, more AI in the review queue, one more hire. It helps for a while, but it doesn’t fix the real problem. Any program that needs a human decision for every change will grow with engineering output, and engineering output is now growing faster than any security team can hire.

So the goal shouldn’t be faster reviews. It should be needing fewer of them.

The model: humans set policy, the environment enforces it

In this model, no security engineer approves or blocks a deployment. Instead, the security team builds the systems that make those decisions automatically. We need a couple of pillars established for this model to run smoothly:

• Secure defaults. Templates, libraries, and infrastructure modules make the safe choice the easy choice, so fewer vulnerabilities get written in the first place.
• Automatic risk scoring. Every change gets a risk score based on what it touches and how critical the asset is. Low-risk changes move fast. High-risk changes get a deeper look.
• AI-filtered findings. Models grounded in your own codebase remove false positives and suggest fixes that look like your developers wrote them.
• Assurance scores instead of approvals. Every service has a health score that the deployment pipeline reads directly. Healthy services ship freely. Unhealthy services face limits proportional to their risk.
• Feedback loops. Recurring findings become new secure defaults. When a security engineer makes a call on a new issue, that call becomes a rule, so nobody has to make it twice.

The last one is what makes everything else work. It’s surprising how many programs fix the same bug class over and over across different teams. A program that learns eliminates the class.

What this looks like in practice

Every piece of this model has already worked at scale somewhere. What’s new is putting them together, with AI connecting them.

Netflix replaced reviews with a paved road. Their AppSec team concluded that per-app security assessments didn’t scale anymore and invested in secure-by-default frameworks and self-service guidance instead. One example is Wall-E, a gateway that handles authentication for web applications. The team rewrote their checklists to push developers toward Wall-E as a pre-approved default. When a team couldn’t use it, the security team extended Wall-E instead of granting an exception. By 2021, Wall-E fronted over 350 applications, and its adoption rate was on every leader’s security risk dashboard. Notice that accountability came from a metric, not an approval.

Google shows what happens when you design a vulnerability class out instead of catching it earlier. This isn’t shift left. Shift left moves detection closer to the developer, but someone still has to find and fix every bug. Google moved responsibility for safety away from the developer and into its languages, libraries, and frameworks. Before 2012, frontends like Gmail had a few dozen XSS vulnerabilities a year. After refactoring onto safe-by-design frameworks, that dropped to near zero. This month, an internal Google AI agent found over 500 XSS vulnerabilities across Google’s broader web applications, and only two across the hundreds built on its hardened frameworks.

And this isn’t just for tech companies. Capital One, a heavily regulated bank, built its own policy-as-code guardrails in 2016 to monitor and automatically fix cloud configurations against enterprise policy.

In none of these cases did the review get faster. The need for it went away.

Three lessons for security leaders

1. Accountability doesn’t require approval. The first question every executive asks is: if nobody signs off, who is accountable? The answer is consequences tied to risk. A service that stays unhealthy loses privileges that would increase its exposure, like frequent deploys, new dependencies, or autoscaling. At planning time, security health sits right next to reliability, and teams below the threshold get capacity reserved for recovery. When the constraint comes through engineering planning, it’s no longer a negotiation with the security team.

2. Measure what the program no longer has to do. Counting completed reviews rewards the wrong thing. The single most useful metric is the human touch rate: the percentage of changes that need any security engineer involvement. It should go down every quarter. Pair it with time to
remediate critical findings and the false positive rate. A falling touch rate is also how security coverage grows without headcount growing at the same pace.

3. Plan for the AI being wrong. The worst case is a false positive that blocks a team who knows the finding isn’t real. Therefore, give developers a fast way to escalate. The disputed finding should stop counting against them immediately, a security engineer should review it within hours, and every decision should go back into the model. Also, be honest about what automation can’t do. It doesn’t reliably catch business logic flaws, design complex authorization, or decide how much risk the business should accept. That’s where your senior security talent belongs, and this model gives them the time for it.

Where to start

Don’t start with AI. Models need your organization’s data to be accurate, and that data comes from the basics: consistent scanning, an inventory of services with criticality and data classification, and simple rule-based risk scoring. Make assurance scores visible before you enforce them. Add machine learning once you have several months of history. Expect about a year before the program starts improving on its own.

The takeaway

AppSec used to be measured by how many reviews it did. At AI speed, the better measure is how few reviews the organization needs while risk goes down and delivery speeds up. Make the secure path the easiest path, and let the environment do the enforcing.

About the Author

Aparna Ash Himmatramka leads an application security engineering team at Amazon.com. She will present this model at Hacker Halted 2026. The views expressed are her own.

The post Stop Reviewing Faster: A Practical Model for AppSec at AI Speed appeared first on CISO MAG | Cyber Security Magazine.

By Alex Holden, Chief Information Security Officer Hold Security

For nearly two decades I made the Dark Web a place to be; however, I am a hacker nor a cyber threat actor. I am a cyber threat intelligence professional with a deep passion for cybersecurity.

After spending a decade in the 2000s in corporate security, I realized that as a CISO, I neglected to understand the enemy. The bad guys who are actually trying to hack our systems.

We spent significant amounts of time and resources building defenses. We worried about vulnerabilities, malware, compliance, firewalls, authentication, policies, and the latest technologies promising to make us more secure. But too many of our efforts were driven by reactions to ongoing attacks, fears, industry headlines, and sometimes fear-mongering from vendors.

We were looking at cybersecurity almost entirely from our side of the battlefield.

Turning my eyes toward the Dark Web helped me understand the enemy and scale defenses to the actual threats and approaches being used against us.

Just think about how quickly technology evolves. Tools change. Encryption changes. Evasion becomes more sophisticated. Infrastructure becomes distributed and disposable. Today, AI is accelerating portions of that evolution even further. Our ability to defend gets tougher because the technology on both sides continues to change.

What stayed relatively static?

The threat actors themselves.

They are people too and they dwell amongst us in our society. They make mistakes. They have goals and motivations. They have egos. They need money or information. They trust the wrong people. They get angry. They compete with each other. They brag about success and complain about failure.

And criminals need other criminals.

A successful cyberattack is rarely just somebody sitting alone in a dark room wearing a hoodie. There is an ecosystem behind cybercrime. Someone develops malware. Someone finds vulnerabilities. Someone obtains access. Someone sells access. Someone steals information. Someone launders money. Someone negotiates ransomware payments. Someone buys the stolen data.

Those relationships create intelligence opportunities.

Going to the Dark Web gave me an opportunity to learn about the enemy and gave me more tools to deter and prevent cyberattacks and breaches.

It also taught me that you cannot understand cybercrime simply by collecting indicators of compromise.

An IP address can tell you where something happened. A malware sample can tell you how something works. Logs can tell you what happened inside your environment.

But none of those necessarily tell you why you were attacked, what the criminal was looking for, what they succeeded in taking, what they plan to do next, or whether they are coming back.

For that, sometimes you need to understand the people behind the attack.

Running a diverse team that engages threat actors and keeps an eye on the pulse of the Dark Web allowed us to discover and investigate many of the highest-profile breaches of all time.

Sometimes it means getting inside a ransomware gang and understanding how they function. Who actually makes decisions? How do they choose victims? How much information do the people negotiating with the victim really have? If a victim pays, should they rely on the word of criminals that the stolen information will really be deleted?

Sometimes it means understanding the threat actor’s view of a breach. Companies naturally investigate incidents by looking inward. What systems were compromised? What logs exist? What data could have been accessed?

But attackers may already be talking about what they actually obtained.

That creates a completely different perspective.

There is an enormous difference between information that could have been stolen and information that actually was stolen. There is also a difference between what criminals claim to have and what they really possess. Understanding that difference requires more than automated monitoring. It requires context, history, access, and understanding how these communities operate.

The same applies to tracking nation-state threat actors. Their motivations are different, but they are still people operating within organizations and relationships. Watching their dynamics, infrastructure, interests, tools, and targets helps us understand not only what happened yesterday, but what may become important tomorrow.

There is another misconception about the Dark Web that is especially important.

There is a lot of stolen data on the Dark Web, but data stolen does not always translate to data abused.

That distinction creates opportunity.

Credentials may be stolen before somebody uses them. Corporate access may be offered for sale before ransomware operators purchase it. A database may circulate privately before criminals figure out how to monetize it. Sensitive information may appear in one criminal community before spreading into many others.

Once data has been weaponized, our options become much more limited.

Before that happens, there may still be time.

We can reset credentials. Disable accounts. Investigate compromised systems. Change access rights. Notify organizations. Watch for fraud. Understand how the compromise happened and prevent the next stage of the attack.

This is one of the reasons simply searching the Dark Web for a company name is not enough.

The real question is not just, “Is our data there?”

The questions are: Who has it? Where did it come from? How recent is it? Is it legitimate? Who else is interested in it? What can they do with it? And perhaps most importantly, what are they likely to do next?

That is where information starts becoming actionable intelligence.

The Dark Web has changed considerably during the years I have been watching it. Communities disappear. Criminal marketplaces get seized. New communication platforms replace old ones. Criminals move between public forums, private channels, messaging applications, invitation-only communities, and direct relationships. Artificial Intelligence…

The location changes.

The need for criminals to communicate, collaborate, sell, buy, recruit, and monetize does not.

That is why understanding the Dark Web is not about knowing the address of a few criminal forums. It is about understanding the ecosystem.
The bottom line that every cybersecurity professional needs to be aware of is that the Dark Web is a pulse of cybercrime.

Ignoring it today is dangerous.

You do not need to become a Dark Web investigator yourself, but somebody in your security strategy needs to understand what is happening outside your network, not just what your security tools are telling you from inside it.

I learned a long time ago that defending only from your own point of view leaves a significant blind spot.

Therefore, I go to the Dark Web every single day.

To understand the enemy. To see what is changing. To find opportunities before vulnerable or stolen information becomes weaponized. To defend. To deter.

And to make the cyber world a bit better.

The post Why I Go to the Dark Web Every Day appeared first on CISO MAG | Cyber Security Magazine.

LinkedIn is adding trust and verification features aimed at making fake professional identities, invented work histories, and company impersonation harder to pull off.

The company is responding to an environment in which generative AI enables imposters to create an entirely made-up professional persona. It reduces the cost of creating convincing headshots, biographies, résumés, outreach messages, and recommendations.

LinkedIn’s new features use verified people and company Pages to help check other users’ claims.

Colleague and classmate vouching: People can confirm that they worked or studied with someone during the period listed on that person’s profile. This confirms an affiliation; it does not rate the person’s ability or recommend them.

Employer control over false affiliations: Admins of verified company Pages can remove people who falsely claim to work there from the company’s associated people and search results. This doesn’t remove the person’s profile or erase the claim from it.

Workplace verification requirement (in testing): LinkedIn is testing a setting that would require people who want to associate themselves with a company Page to verify their workplace, for example, through a work email address.

Verified identity beyond LinkedIn: LinkedIn is extending partnerships that let users display their LinkedIn-verified identity elsewhere. New partners include Truecaller and PeerSpot, alongside Adobe and UserTesting.

LinkedIn hopes that multiple visible signals such as identity verification, workplace verification, peer corroboration, and company Page controls will make a fabricated profile less persuasive. It says its existing verification tools have verified 115 million members and more than 700,000 companies.

LinkedIn VP of Product Oscar Rodriguez told TechCrunch:

“We’ve been invested in [verification] because we believe that authenticity will be the single most valuable currency on the internet.”

These new affiliation checks cannot tell a job seeker whether an opportunity is genuine. A scammer does not always need to impersonate a major employer. They can invent a convincing startup, build a polished company Page, and use fake job listings or recruiters to lure applicants. The checks may be less helpful if the supposed employer itself is part of the scam.

As we’ve seen in recent research, criminals pose as both well-known companies and appealing new ventures offering the kind of role a job seeker hopes to find. The new checks may help someone determine whether a supposed recruiter is affiliated with a company they recognize. They may be less helpful when the company itself is part of the scam.

Verification is therefore a useful signal, not a guarantee. Job seekers should still be wary of unsolicited approaches, pressure to move conversations off LinkedIn, requests to install software or share identity documents, and job offers that arrive before a credible interview process. Check a recruiter’s affiliation, visit the employer’s website independently, and confirm that its contact details and job listing match.

LinkedIn’s changes acknowledge a growing problem: AI can make a fake professional identity look remarkably polished. Verified accounts, workplace affiliations, and colleague confirmations may become more valuable to criminals, too. They may try to exploit those signals through stolen accounts, manipulated verification, or carefully constructed networks of fraudulent profiles. Verification can raise the cost of deception, but it cannot replace healthy skepticism.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

LinkedIn is adding trust and verification features aimed at making fake professional identities, invented work histories, and company impersonation harder to pull off.

The company is responding to an environment in which generative AI enables imposters to create an entirely made-up professional persona. It reduces the cost of creating convincing headshots, biographies, résumés, outreach messages, and recommendations.

LinkedIn’s new features use verified people and company Pages to help check other users’ claims.

Colleague and classmate vouching: People can confirm that they worked or studied with someone during the period listed on that person’s profile. This confirms an affiliation; it does not rate the person’s ability or recommend them.

Employer control over false affiliations: Admins of verified company Pages can remove people who falsely claim to work there from the company’s associated people and search results. This doesn’t remove the person’s profile or erase the claim from it.

Workplace verification requirement (in testing): LinkedIn is testing a setting that would require people who want to associate themselves with a company Page to verify their workplace, for example, through a work email address.

Verified identity beyond LinkedIn: LinkedIn is extending partnerships that let users display their LinkedIn-verified identity elsewhere. New partners include Truecaller and PeerSpot, alongside Adobe and UserTesting.

LinkedIn hopes that multiple visible signals such as identity verification, workplace verification, peer corroboration, and company Page controls will make a fabricated profile less persuasive. It says its existing verification tools have verified 115 million members and more than 700,000 companies.

LinkedIn VP of Product Oscar Rodriguez told TechCrunch:

“We’ve been invested in [verification] because we believe that authenticity will be the single most valuable currency on the internet.”

These new affiliation checks cannot tell a job seeker whether an opportunity is genuine. A scammer does not always need to impersonate a major employer. They can invent a convincing startup, build a polished company Page, and use fake job listings or recruiters to lure applicants. The checks may be less helpful if the supposed employer itself is part of the scam.

As we’ve seen in recent research, criminals pose as both well-known companies and appealing new ventures offering the kind of role a job seeker hopes to find. The new checks may help someone determine whether a supposed recruiter is affiliated with a company they recognize. They may be less helpful when the company itself is part of the scam.

Verification is therefore a useful signal, not a guarantee. Job seekers should still be wary of unsolicited approaches, pressure to move conversations off LinkedIn, requests to install software or share identity documents, and job offers that arrive before a credible interview process. Check a recruiter’s affiliation, visit the employer’s website independently, and confirm that its contact details and job listing match.

LinkedIn’s changes acknowledge a growing problem: AI can make a fake professional identity look remarkably polished. Verified accounts, workplace affiliations, and colleague confirmations may become more valuable to criminals, too. They may try to exploit those signals through stolen accounts, manipulated verification, or carefully constructed networks of fraudulent profiles. Verification can raise the cost of deception, but it cannot replace healthy skepticism.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Blogs

Blog

How to Align and Measure Threat Intelligence Operations: Flashpoint Priority Intelligence Requirements

In this post, we explore how Flashpoint’s new Intelligence Requirements capability helps organizations define, manage, and operationalize PIRs directly within Ignite by connecting intelligence priorities, monitoring activity, investigations, and measurable operational outcomes into a more unified workflow.

SHARE THIS:

Flashpoint

May 29, 2026

Table Of Contents

Table of Contents

Turning Intelligence Priorities Into Operational Workflows

Building Signals Around Intelligence Questions

Creating a Stronger Feedback Loop Between Monitoring and Prioritization

Connecting Intelligence Activity to Collaborative Investigations

Supporting More Mature Intelligence Operations

More

subscribe to our newsletter

For many intelligence teams, the hardest part of the intelligence lifecycle is no longer collection. It is operationalization.

Analysts are flooded with incoming activity every day, from credential exposures and actor chatter to vulnerability reporting and operational alerts. But without a structured way to connect those signals to business priorities and operational risk, many organizations still struggle to translate intelligence activity into actionable decisions and measurable outcomes.

That is exactly the problem Intelligence Requirements (IRs) are designed to solve.

With the introduction of Intelligence Requirements in Flashpoint Ignite, organizations can define, manage, and operationalize both General Intelligence Requirements (GIRs) and Priority Intelligence Requirements (PIRs) directly within their day-to-day intelligence workflows. By bringing intelligence priorities, monitoring activity, investigations, and reporting into a more unified operational model, teams can create clearer alignment between intelligence operations and organizational risk.

With Intelligence Requirements, organizations can:

• Centralize and structure General Intelligence Requirements and Priority Intelligence Requirements (PIRs) directly within Ignite to create clearer alignment across intelligence operations.
• Connect alerts and monitoring activity to business priorities and organizational risk to improve focus and prioritization.
• Tie intelligence findings directly to Investigations workflows to support faster triage, collaboration, and response.
• Accelerate adoption with pre-built PIR templates or create custom intelligence requirements tailored to organizational priorities.
• Gain measurable visibility into intelligence activity, investigative trends, and how CTI supports operational and business outcomes.

“The most effective threat intelligence programs are the ones aligned directly to the priorities that matter most to an organization — from reducing operational risk to enhancing executive and mission-level decision-making,” said Josh Lefkowitz, Co-Founder and CEO of Flashpoint. “With Intelligence Requirements, Flashpoint is helping organizations with the critical effort to define and operationalize those priorities across intelligence workflows — creating a clearer connection between threat intelligence programs and outcomes.”

Turning Intelligence Priorities Into Operational Workflows

At its core, a Priority Intelligence Requirement represents a question an organization needs answered.

Examples might include:

• Are credentials tied to our organization appearing in underground communities?
• Is a ransomware group targeting organizations in our industry?
• Are discussions about our executives increasing across threat actor forums?
• Is new malware infrastructure emerging that overlaps with our environment?

Historically, PIRs have existed outside operational workflows entirely — tracked through spreadsheets, slide decks, ticketing systems, or institutional knowledge spread across analyst teams. Meanwhile, alerting, investigations, and reporting frequently operated across disconnected processes, making it difficult to maintain clear alignment between intelligence activity and organizational priorities.

The challenge is, as intelligence programs scale, that fragmentation creates operational friction. Analysts spend more time organizing workflows, managing signals, and explaining priorities instead of focusing on the intelligence questions that matter most.

Inside Ignite, Intelligence Requirements provide a more structured operational framework that connects:

• Intelligence priorities
• Monitoring activity
• Investigations
• Triage workflows
• Collaboration
• Operational outcomes

Building Signals Around Intelligence Questions

Once an Intelligence Requirement is defined, teams can begin building the signals designed to answer that requirement.

This transforms the role alerting plays within intelligence operations.

Rather than creating isolated alerts with little context, analysts can associate alerts directly to specific Intelligence Requirements. Those alerts become observable signals tied to the intelligence questions the organization is trying to answer.

For example:

• A credential exposure alert may support an identity-focused PIR
• Ransomware reporting alerts may support an executive risk PIR
• Actor chatter or malware discussions may support a geopolitical monitoring PIR

This creates significantly more clarity for analysts:

• Why does this alert exist?
• What intelligence priority does it support?
• Which signals are actually producing meaningful operational value?

As intelligence programs mature, that visibility becomes increasingly important beyond the analyst team itself. Security leaders are under growing pressure to explain how intelligence activity supports operational priorities, business risk reduction, and executive decision-making.

By organizing alerts around intelligence requirements instead of individual datasets alone, organizations gain a more operational view of intelligence activity and its relevance to broader business objectives.

Creating a Stronger Feedback Loop Between Monitoring and Prioritization

One of the biggest challenges intelligence teams face today is alert fatigue.

Large volumes of alerts can overwhelm analysts and obscure the signals most relevant to operational risk. Over time, this makes it harder to prioritize analyst attention, refine monitoring strategies, and understand which intelligence activity is actually producing operational value.

Intelligence Requirements help bring more structure and context to monitoring workflows by connecting incoming activity directly to defined intelligence priorities.

Instead of reviewing alerts in isolation, analysts can evaluate activity within the context of the PIRs it supports. This gives teams clearer visibility into:

• Which signals consistently produce meaningful intelligence
• Where noisy monitoring workflows are slowing analysts down
• Which intelligence priorities are driving the most operational activity
• How analyst effort aligns to organizational risk

Over time, this creates a stronger operational feedback loop. Monitoring workflows can be refined based on investigative outcomes, low-value signals become easier to identify, and teams gain a clearer understanding of which intelligence activity deserves the most attention.

The result is a more intentional and measurable approach to intelligence monitoring that helps analysts spend less time managing noise and more time focusing on operationally relevant signals.

Connecting Intelligence Activity to Collaborative Investigations

Prioritizing signals is only part of the workflow.

When activity warrants deeper analysis, analysts can move directly from alert triage into Investigations within Ignite. This is where Intelligence Requirements begin connecting monitoring activity to collaborative operational response.

Investigations provide a centralized environment where teams can organize findings, preserve investigative context, track evolving activity, coordinate across stakeholders, and develop operational reporting around emerging threats.

Importantly, investigations remain connected back to the original Intelligence Requirement, helping preserve the broader operational context behind the work and maintain alignment between investigative activity and organizational priorities.

This creates a more continuous operational process:

1. Define the intelligence question
2. Build monitoring workflows around relevant signals
3. Prioritize incoming intelligence
4. Escalate meaningful findings into investigations
5. Collaborate, analyze, and report on operational activity
6. Refine monitoring workflows based on outcomes

Within Ignite, analysts can also leverage AI Workspace capabilities to accelerate analysis, summarize investigative findings, and support downstream reporting workflows.

By connecting monitoring, investigations, collaboration, and analysis within the same operational framework, organizations gain a clearer understanding of how intelligence activity supports operational decision-making and business risk management.

Supporting More Mature Intelligence Operations

As threat environments become more complex, operational maturity increasingly depends on an organization’s ability to connect priorities, monitoring activity, investigations, and outcomes within the same framework.

That challenge extends beyond the analyst team itself. Intelligence leaders are increasingly expected to demonstrate how intelligence activity supports operational priorities, informs risk decisions, and contributes to broader business objectives.

Intelligence Requirements help organizations create a more structured and measurable operational model by connecting intelligence priorities directly to monitoring workflows and investigations inside Ignite.

Over time, this gives organizations clearer visibility into:

• which priorities are generating operational activity
• where analysts are spending investigative effort
• how intelligence supports organizational risk management
• how CTI workflows contribute to operational and business outcomes

By reducing fragmentation across workflows and maintaining stronger alignment between intelligence activity and organizational priorities, teams can spend less time managing process and more time focusing on the intelligence questions most relevant to the business.

Learn more about Flashpoint Intelligence Requirements and request a demo.

The post How to Align and Measure Threat Intelligence Operations: Flashpoint Priority Intelligence Requirements appeared first on Flashpoint.

Some software providers have decided to lead by example and offer users a choice about the Artificial Intelligence (AI) features built into their products.

The latest example is Mozilla, which now offers users a one-click option to disable generative AI features in the Firefox browser.

Audiences are divided about the use of AI, or as Mozilla put it on their blog:

“AI is changing the web, and people want very different things from it. We’ve heard from many who want nothing to do with AI. We’ve also heard from others who want AI tools that are genuinely useful. Listening to our community, alongside our ongoing commitment to offer choice, led us to build AI controls.”

Mozilla is adding an AI Controls area to Firefox settings that centralizes the management of all generative AI features. This consists mainly of a master switch, “Block AI enhancements,” which lets users effectively run Firefox “without AI.” It blocks existing and future generative AI features and hides pop‑ups or prompts advertising them.

Once you set your AI preferences in Firefox, they stay in place across updates. You can also change them whenever you want.

Starting with Firefox 148, which rolls out on February 24, you’ll find a new AI controls section within the desktop browser settings.

You can turn everything off with one click or take a more granular approach. At launch, these features can be controlled individually:

• Translations, which help you browse the web in your preferred language.
• Alt text in PDFs, which add accessibility descriptions to images in PDF pages.
• AI-enhanced tab grouping, which suggests related tabs and group names.
• Link previews, which show key points before you open a link.
• An AI chatbot in the sidebar, which lets you use your chosen chatbot as you browse, including options like Anthropic Claude, ChatGPT, Microsoft Copilot, Google Gemini and Le Chat Mistral.

We applaud this move to give more control to the users. Other companies have done the same, including Mozilla’s competitor DuckDuckGo, which made AI optional after putting the decision to a user vote. Earlier, browser developer Vivaldi took a stand against incorporating AI altogether.

Open-source email service Tuta also decided not to integrate AI features. After only 3% of Tuta users requested them, Tuta removed an AI copilot from its development roadmap.

Even Microsoft seems to have recoiled from pushing AI to everyone, although so far it has focused on walking back defaults and tightening per‑feature controls rather than offering a single, global off switch.

Choices

Many people are happy to use AI features, and as long as you’re aware of the risks and the pitfalls, that’s fine. But pushing these features on users who don’t want them is likely to backfire on software publishers.

Which is only right. After all, you’re paying the bill, so you should have a choice. Before installing a new browser, inform yourself not only about its privacy policy, but also about what control you’ll have over AI features.

Looking at recent voting results, I think it’s safe to say that in the AI gold rush, the real premium feature isn’t a chatbot button—it’s the off switch.

We don’t just report on privacy—we offer you the option to use it.

Privacy risks should never spread beyond a headline. Keep your online privacy yours by using Malwarebytes Privacy VPN.

Meta plans to test exclusive features that will be incorporated in paid versions of Facebook, Instagram, and WhatsApp. It confirmed these plans to TechCrunch.

But these plans are not to be confused with the ad-free subscription options that Meta introduced for Facebook and Instagram in the EU, the European Economic Area, and Switzerland in late 2023 and framed as a way to comply with General Data Protection Regulation (GDPR) and Digital Markets Act requirements.

From November 2023, users in those regions could either keep using the services for free with personalized ads or pay a monthly fee for an ad‑free experience. European rules require Meta to get users’ consent in order to show them targeted ads, so this was an obvious attempt to recoup advertising revenue when users declined to give that consent.

This year, users in the UK were given the same choice: use Meta’s products for free or subscribe to use them without ads. But only grudgingly, judging by the tone in the offer… “As part of laws in your region, you have a choice.”

That ad-free option, however, is not what Meta is talking about now.

The newly announced plans are not about ads, and they are also separate from Meta Verified, which starts at around $15 a month and focuses on creators and businesses, offering a verification badge, better support, and anti‑impersonation protection.

Instead, these new subscriptions are likely to focus on additional features—more control over how users share and connect, and possibly tools such as expanded AI capabilities, unlimited audience lists, seeing who you follow that doesn’t follow you back, or viewing stories without the poster knowing it was you.

These examples are unconfirmed. All we know for sure is that Meta plans to test new paid features to see which ones users are willing to pay for and how much they can charge.

Meta has said these features will focus on productivity, creativity, and expanded AI.

My opinion

Unfortunately, this feels like another refusal to listen.

Most of us aren’t asking for more AI in our feeds. We’re asking for a basic sense of control: control over who sees us, what’s tracked about us, and how our data is used to feed an algorithm designed to keep us scrolling.

Users shouldn’t have to choose between being mined for behavioral data or paying a monthly fee just to be left alone. The message baked into “pay or be profiled” is that privacy is now a luxury good, not a default right. But while regulators keep saying the model is unlawful, the experience on the ground still nudges people toward the path of least resistance: accept the tracking and move on.

Even then, this level of choice is only available to users in Europe.

Why not offer the same option to users in the US? Or will it take stronger US privacy regulation to make that happen?

We don’t just report on threats – we help protect your social media

Cybersecurity risks should never spread beyond a headline. Protect your social media accounts by using Malwarebytes Identity Theft Protection.

Table Of Contents

Table of Contents

Video as Essential Threat Intelligence

What is Flashpoint Video Search Technology?

What Can Flashpoint Video Search Identify?

Access Flashpoint Video Search Today

Frequently Asked Questions (FAQs)

More

subscribe to our newsletter

Video as Essential Threat Intelligence

When advertising and selling their services, or boasting about their exploits, threat actors will often post media, including video, to illicit communities that serve as proof points for potential buyers and partners.

They showcase sensitive information and stolen goods, including: stolen identities, compromised bank accounts, checks, and stolen credit cards; gift cards and receipts; fake, unlicensed merchandise; ATM skimmers and shimmers, guns and drugs, exploit code, RDP access, brand impersonation, physical security threats, and much more.

Now, video use amongst threat actors is on the rise, as media-rich, mobile-first communication is becoming a primary mode of communication in illicit communities. Gaining visibility into this threat landscape is essential intelligence to CTI, Fraud, Brand Protection, and Physical Security teams, among other practitioners whose job it is to protect against exposure to fraud, corporate brand abuse, and acts of violence: 

Even better is having a way to search this media across text, images, and video in order to identify potential threats. Flashpoint offers all three—and our new video search analysis is a unique offering on the market.

What is Flashpoint Video Search Technology?

Building on the success of our OCR capability for images, security teams can now surface threats in videos posted by threat actors using object detection, logo detection, text extraction, and explicit content detection directly within the Flashpoint Intelligence Platform.

Security teams across various industries in public and private sectors have realized the value of searching for, and being alerted on, images of company assets that pop up on open-source and darknet communities. Flashpoint’s video search analysis expands the scope of coverage, offering additional insights into a fast-growing medium used by threat actors.

What Can It Identify?

Video search analysis gives teams the ability to search for and generate keyword specific alerts for text, logos, and organizational assets inside videos across Flashpoint intelligence collections. Flashpoint’s new video search analysis helps to identify: 

• Labels and objects, including products, locations, activities, and animal species
• Logos, including a library of more than 100,000 brand-specific media
• Text, including the detection and extraction of text within an input video using OCR
• Explicit content, including adult content in videos, which is generally defined as inappropriate for people under the age of 18

What Can Flashpoint Video Search Identify?

Video search analysis equips security teams with the additional tools and intelligence they need in their missions of preventing fraud and protecting their organization.

Financial Fraud

Search for a bank or institution name to discover videos with that particular logo or text in them. Locate a threat actor boasting about ATM access, logos or text on a check or receipts, or of a physical brick and mortar building. Video search analysis can be used to uncover instances of threat actors engaging in using ATMs to extract cash, duplicating false checks, credit card fraud, and POS skimmers. 

Additionally, Flashpoint financial services customers have found countless instances of potentially fraudulent accounts, checks, and cards using image OCR—and our new video search analysis functionality will only enhance and increase the ability to prevent financial fraud. One Flashpoint financial services customer detected more than $4M in illicitly marketed assets, including checks and compromised accounts, using our OCR capabilities.

Physical Security 

Enhance executive protection by monitoring for specific personally identifiable information (PII) related to employees, executives, and organizations. With this, physical security teams can work to prevent acts of violence and crimes or threats at points of interest, events, or physical locations. 

Brand Protection

Monitor for an organization’s brand in videos shared by illicit actors, including the ability to identify insider threats via videos of compromised web servers, compromised customer accounts, and stolen merchandise. 

Access Flashpoint Video Search Today

Learn more about how Flashpoint’s industry-first video search technology can help your teams surface logos, text, explicit content, and other critical intelligence.

Frequently Asked Questions (FAQs)

What is Flashpoint Video Search and how does it help investigators?

Flashpoint Video Search is an industry-first technology within the Flashpoint Intelligence Platform that allows users to search for specific objects, text, and logos inside video files. It helps investigators by surfacing critical intelligence from videos posted in illicit communities, such as threat actors boasting about stolen bank accounts, showing off illegal weapons, or demonstrating how to use POS skimmers.

Flashpoint Video Search Capability	Investigative Benefit
Logo Detection	Identifies a library of 100,000+ brand logos inside video frames.
Text Extraction (OCR)	Reads and pulls text, such as names on checks or credit cards, from video.
Object Labeling	Detects physical items like ATM skimmers, guns, or specific products.

How does Flashpoint Video Search assist in preventing financial fraud?

Flashpoint Video Search assists in preventing financial fraud by allowing banks and institutions to scan for their brand names and assets in videos shared on the dark web. Fraud teams can use Flashpoint to find threat actors showcasing “proof” of their exploits, such as videos of cash being extracted from compromised ATMs or close-ups of stolen checks and credit cards, enabling the bank to cancel those assets immediately.

• Asset Recovery: Surfaces compromised accounts and cards before they can be fully exploited.
• Skimmer Detection: Identifies videos showing the installation or use of physical POS skimmers.
• Risk Mitigation: Helps organizations detect and prevent millions of dollars in potential losses.

Why is Flashpoint Video Search unique for brand and physical protection?

Flashpoint Video Search is unique for brand and physical protection because it provides visibility into a fast-growing medium that traditional text-based search tools miss. Physical security teams can use Flashpoint to detect threats against executives or facilities by monitoring for specific faces or locations in videos. Brand protection teams can identify insider threats by finding videos of stolen merchandise or compromised corporate servers that are being marketed for sale.

Protection Type	Flashpoint Application
Brand Protection	Finds videos of counterfeit products or brand impersonation attempts.
Executive Protection	Monitors for leaked PII or visual threats against high-profile personnel.
Physical Security	Identifies threats at specific physical locations, events, or points of interest.

The post The Risk-Reducing Power of Flashpoint Video Search appeared first on Flashpoint.