Cyber Threat Intelligence
Some of Your Data Is Already Out There.
Cyber Threat Intelligence reads breach data, infostealer logs and dark web sources for your domains, your employees and your customers, and profiles the threat actors aimed at your sector.
Every exposure is tied to something your team can act on: an account, a device, a credential or a card.
- Your building, whole: none of this touches your network.
- Employee email breach: a service your staff signed up for was breached; j.•••@acme.example is in it, with passwords, phone numbers, names, job titles.
- Infected device: an employee laptop at home; an infostealer took its saved passwords and session cookies, and the log is sold on a dark web market.
- Executive threat: the Chief Financial Officer, flagged as an executive, so the exposure that touches leadership is handled first.
- Client credential: a customer signing in on a phone; the login for login.acme.example leaked.
- Payment card: a card ending 4821 on a BIN you watch, listed on a market.
- Dark web mentions: on a forum, credentials for acme.example offered.
- Threat actors: Actor C and Actor F target your sector and use CVE-2021-44228.
- Also in CTI: Dark Web Search, Data Breach Index, IOC Feeds, Cybersecurity News, Cyber Threat Score.
Exposure That Never Touches Your Network.
Your logs record what happens inside the perimeter. The exposures CTI finds happened somewhere else: in another company’s breach, on a device you don’t manage, in a market your tools never see.
Other breaches
A Service Your Staff Signed Up For
When a third party is breached, the corporate addresses registered there leak with whatever was stored beside them. A reused password turns their breach into yours.
Unmanaged devices
A Laptop Outside Your Fleet
An infostealer on a personal or contractor machine takes the browser’s saved logins, cookies and autofill data, including the entries for your SSO and VPN.
Closed venues
Forums, Markets and Leak Sites
Stolen data and access change hands in places search engines don’t index. Nobody sends the victim a notice.
Monitoring and Context in One Picture.
The monitoring capabilities match breaches, stealer logs and leaked credentials to your domains. Threat actor profiles and news supply the context.
Monitoring
breaches, stealer logs and leaked credentials, matched to your domains
-
Lands on: a name or domain
Your organization’s names and domains, watched on dark web sources instead of searched by hand.
-
Employee Email Breach Monitoring
Lands on: an account
Corporate addresses in known breaches, and the data types that leaked with them.
-
Compromised Employee Device Monitoring
Lands on: a device
Infostealer infections on devices that hold your employees’ credentials.
-
Compromised Client Credential Monitoring
Lands on: a credential
Your customers’ leaked logins for your services, each tracked through a state.
-
Compromised Payment Credential Monitoring
Lands on: a card
Leaked payment cards linked to your organization, worked through the same states.
-
Lands on: a person
Executives and VIPs flagged, so the exposures that touch leadership are handled first.
Context
threat actor profiles and news
-
Lands on: an actor
Origin countries, targeted regions, industries and organizations, and the CVEs and tools each actor uses.
-
Lands on: a story
Curated news, each item linked to the CVEs, threat actors and issue types it concerns.
Also in CTI
- Dark Web Searchthe same sources, queried by text or indicator
- Data Breach Indexthe catalog of breaches behind the monitoring
- IOC Feedsindicators, packaged for detection and blocking
- Cyber Threat Scorethe scoring layer across the Deepinfo Platform
Each Finding Arrives Tied to an Account, a Device or a Person.
CTI keeps findings as structured records, not headlines. Each record points at an account, a device, a credential or an actor, and each one is searchable under / in the API.
| Breached account | The corporate address, the breaches it appears in, and the profile fields your team sets: VIP flag, name, title |
|---|---|
| Breach | Date, description, the data types exposed and the number of your accounts affected |
| Compromised device | Hardware ID, user and system info, password, token, autofill, cookie and sensitive-cookie counts, same-password rate |
| Leaked credential | An employee login, a customer login for your services or a payment card, each with the state your team has set |
| Threat actor | Identity and profile, origin countries, activity across leaks, forums and markets, targets, and the CVEs and tools used |
| News item | The story, linked to the CVEs, threat actors and issue types it concerns |
Compromised devices, employee credentials and threat actors each have their own search, using the platform’s filter syntax.
From Leaked Credential to Closed Finding.
Closing a credential finding doesn’t delete it. Each one carries a state, so the next analyst can see what was decided and revert it if the call was wrong.
-
01
Collect
Deepinfo collects breach data, infostealer logs and dark web content, and indexes each record for search.
-
02
Match
Records are matched to your domains and services, so each finding lands on an address, a device, a credential or a card.
-
03
Decide
Your team marks a credential resolved, accepts the risk, ignores it or marks it a false positive, one at a time or by filter. Revert restores the previous state.
-
04
Report
New email breaches trigger a notification at the frequency you choose, from instant to monthly. The CTI Email Breach Summary is a PDF report, on demand or on a schedule.
Know Which Actors Target Organizations Like Yours.
Each profile records who the actor is (size, types, sophistication and specializations), where it comes from, which leaks, forums and markets it shows up in, and whom it targets, down to regions, countries, industries and organizations.
Capabilities are recorded too: the CVEs and the tools the actor uses. Filter by industry to see who is aimed at your sector, then check those CVEs against what External Attack Surface Management finds on your assets.
- Most targeted
- Countries, industries, organizations
- Most used
- CVEs and tools
- Actor origin
- Countries hosting the most actors
- Search
- By target, CVE or tool
Query This Data Through the API
Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API. The index holds 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates.
Questions About Cyber Threat Intelligence
What is Cyber Threat Intelligence?
Cyber Threat Intelligence (CTI) is the collection, correlation and delivery of information about the adversaries, exposures and active threats that concern your organization. It turns raw signals such as leaked credentials, infostealer logs, dark web posts and threat actor activity into findings a security team can act on.
What sources does Deepinfo CTI read?
Breach data, infostealer logs, dark web sources (forums, markets, paste sites, leak sites and chat channels), threat actor profiles and curated cybersecurity news. Findings are matched to your corporate domains and your employees, and for client and payment credentials, to your customers.
How is CTI different from generic threat feeds and OSINT?
Generic feeds list indicators that concern everyone. CTI starts from your domains and returns findings tied to your own accounts, devices and credentials. General OSINT search covers the indexed web, while breach data and infostealer logs sit where search engines don’t reach.
What does a typical CTI workflow look like?
Your team adds its corporate domains, and the platform matches breaches, stealer logs and leaked credentials to them. Each credential finding moves through a state: resolved, risk accepted, ignored or false positive. For the infrastructure side, analysts pivot into External Attack Surface Management for exposed assets and Brand Risk Protection for lookalike domains.
Does an empty result mean nothing has leaked?
It means nothing was found in the sources Deepinfo covers. Breach, infostealer and dark web coverage is partial by nature, as the methodology states, so treat a clean result as one input among several.
How does CTI connect to the rest of our stack?
Through the API: breaches, compromised accounts, credentials and devices, threat actors and news are all queryable, and credential findings export in full and take bulk state changes by filter. New email breaches can trigger notification emails, and the CTI Email Breach Summary report comes as a PDF. See the CTI API reference and integrations.
How is CTI priced?
Pricing depends on the scope you monitor. See pricing for how it works, or talk to us for a scoped quote.
See What’s Already Out There About Your Organization.
Book a demo and we’ll walk through CTI findings for your domains.