Philosophy
The oldest job description for this work is more than twenty-five centuries old. A watchman stands on the wall, sees the sword coming and blows the trumpet. If he sees it and keeps quiet, the blood is on his hands. We take that seriously.
But if the watchman see the sword come, and blow not the trumpet, and the people be not warned; if the sword come, and take any person from among them, he is taken away in his iniquity; but his blood will I require at the watchman's hand.
Original collection means being present where stolen data actually moves, instead of repackaging someone else's blog post a week later. The goodman of the house would have watched if he had known the hour. Knowing the hour is the whole product.
If the goodman of the house had known in what watch the thief would come, he would have watched.
We collect what is shared in the open. We don't buy stolen data, pay criminals, trade with them or ask them for anything. Paying for logs funds the next round of infections and puts defenders on the wrong side of the law. Those lines don't move.
And she went, and came, and gleaned in the field after the reapers.
Fake and recycled breaches are an industry of their own. Old combo lists get renamed after famous companies and used for extortion. Everything we ingest is checked against what we have already seen and graded before anyone gets an alert.
Beloved, believe not every spirit, but try the spirits whether they are of God: because many false prophets are gone out into the world.
Every record carries its provenance and a confidence grade. Handles, infrastructure and code get sold and reused, so we say "activity consistent with" before we name anyone, and we show our sources.
In the mouth of two or three witnesses shall every word be established.
Intelligence that never reaches someone who can act on it is trivia. Alerts go out fast, to the right people, with enough context to act without having to open a ticket with us first.
If when he seeth the sword come upon the land, he blow the trumpet, and warn the people.
We hold other people's stolen data, and we act like custodians of it. Secrets are masked by default and encrypted at rest. Full evidence sits behind separate keys and an audit trail. Everything expires. Nobody here uses a leaked credential to log in to anything, ever.
Love worketh no ill to his neighbour: therefore love is the fulfilling of the law.
Threat intelligence has been priced for the Fortune 500 for a long time. Our tagline is Threat Intelligence For All and we mean it literally: pricing an MSP can resell, pricing a small team can afford, research published in the open, and victims warned where we can reach them.
Neither do men light a candle, and put it under a bushel, but on a candlestick; and it giveth light unto all that are in the house.
VIII / Revival
Remember therefore from whence thou art fallen, and repent, and do the first works.
Revival, in the old sense, means going back to first things. Security has drifted toward recycled feeds, dashboards for the sake of dashboards, and vendor theater. We think the craft is due for a revival: original collection, honest tradecraft, and service to the defenders doing the actual work.
That is also why we publish. Findings that help defenders should reach defenders, including the ones who will never be customers.
IX / A note on the names
Because it had the vocabulary first. Watchmen, gleaning, witnesses, lampstands, the trumpet on the wall: those words describe this work better than most security marketing does, and they say something about why we do it. The point of all of it is protecting people.
You don't have to share the faith to use the platform. You only have to want to know before the thief does.
