Cyble, Flashpoint, Group-IB and Recorded Future

About Flashpoint

Flashpoint sells threat data and intelligence that spans cyber threat intelligence, vulnerability intelligence, geopolitical risk, physical security, fraud and brand protection. Flashpoint addresses complex security challenges faced by commercial enterprises and government agencies. Flashpoint builds its EASM offering natively into Flashpoint Ignite, which brings external attack surface management, cyber threat intelligence, physical security with Echosec, and dark web collections into a single workflow. Flashpoint's team spans 8 countries with 35+ languages spoken.^[1][2][4]

Flashpoint's cyber threat intelligence platform combines primary-source collections, analyst expertise and integrated AI, with access to threat intelligence from open and hard-to-reach adversary spaces. Flashpoint aggregates and analyzes data from the open, deep and dark web to track adversary tactics, expose vulnerabilities and predict attacks. Flashpoint provides intelligence based on an organization's Priority Intelligence Requirements. Flashpoint provides real-time threat alerts based on data from open and dark web sources, illicit forums, groups and other primary sources. Flashpoint analysts sort and prioritize threats most relevant to a customer organization's PIRs.^[1][5][6]

Flashpoint uses Automated Source Discovery technology to discover and rapidly add new sources. Flashpoint makes data analysis-ready by applying Optical Character Recognition, geospatial enrichments and machine-learning tags. Flashpoint delivers finished intelligence to stakeholders through secure channels and integrated platform alerts.^[6]

Flashpoint offers vulnerability intelligence that helps customers prioritize vulnerabilities affecting their organization and gain context for mitigation. Flashpoint's vulnerability intelligence includes 105,000+ vulnerabilities omitted from public databases like the NVD. Flashpoint maintains an independent vulnerability collection called VulnDB that tracks over 449,000+ vulnerabilities. Flashpoint KEV tracks over 5,400+ vulnerabilities backed by real-world threat actor activity and dark web chatter. Flashpoint MCP Server gives customers access to Flashpoint intelligence within AI assistants and AI-native workflows using the Model Context Protocol standard.^[5]

Flashpoint's fraud intelligence provides early-warning signals to help organizations prevent financial fraud. Flashpoint users can run searches for credit card information that aligns with their BIN for automatic detection of accounts at risk. Flashpoint users can search illicit marketplaces for usernames and passwords associated with their company domain or variations. Flashpoint fraud intelligence covers cryptocurrency addresses and transactions within Bitcoin, Ethereum and Monero collections. Flashpoint Fraud Intelligence now includes infostealer data to combat credit card fraud. Flashpoint Compromised Credentials Monitoring allows users to monitor exposure of compromised credentials. Flashpoint offers a customer-focused version that lets organizations monitor for compromised customer credentials.^[7][8]

Flashpoint Physical Security Intelligence gathers data from online sources including mainstream social media, discussion forums, fringe networks, messaging apps and regional sources from around the world. Flashpoint Physical Security Intelligence lets users search, filter, monitor, visualize and analyze the data in a dashboard. Flashpoint Physical Security Intelligence offers access to Flashpoint's specialized intelligence team. Echosec is a web-based open-source intelligence capability used by security and intelligence teams worldwide. Echosec delivers finished intelligence and near real-time data from mainstream social media, fringe networks, news outlets, messaging apps and discussion forums. Flashpoint National Security Intelligence combines data, technology and services to deliver information and intelligence to mission-driven teams in Defense, the Intelligence Community, Law Enforcement, Public Safety, State and Local Government, and Federal Civilian Agencies. Flashpoint also offers insider threat intelligence to detect, monitor and mitigate the misuse of authorized access to networks, systems or assets.^[5][9][10]

Flashpoint points to ransomware and other threats to business continuity and intellectual property as risks for healthcare and pharmaceutical companies. Flashpoint offers monitoring of compromised credential exposure for enterprise domains and customer email addresses. Flashpoint offers expert training, response and recovery to prevent, prepare for and mitigate the impacts of ransomware or extortion attacks. Flashpoint lets customers ask its intelligence analysts questions and receive answers to address intelligence gaps. Flashpoint can anonymously and securely engage with threat actors on a customer's behalf. Flashpoint's attack surface offering is supported by over 100 multidisciplinary intelligence experts who deliver finished reporting, custom investigations and on-demand Requests for Information.^[1][12]

About Group-IB

Group-IB is a Prediction-First cybersecurity company built on collective defense. Group-IB has products, intelligence and expertise that work together on a shared data lake. Group-IB offers real-time threat detection and response for endpoints, network, infrastructure and email. Group-IB offers real-time fraud prevention and client-side digital identity protection. Group-IB offers AI-powered digital risk identification and remediation for securing digital assets.^[2][4]

Group-IB's Threat Intelligence solution is available in AWS Marketplace. Group-IB's digital threat intelligence solution, powered by the Unified Risk Platform, integrates with SIEM, SOAR and TIP solutions, or via API and STIIX/TAXII data transfer. Prevyn AI orchestrates 12 Specialist Agents, each expert in one domain of threat intelligence. Group-IB names three agents Compromise Detection, Malicious Infrastructure Detection and Attack Activity, built to anticipate attacks before they happen. Group-IB Threat Intelligence Platform has a graph interface for investigating cyber threats. Group-IB's graph lets users explore the relationship between threat actors, their infrastructure and the tools they use. Group-IB threat intelligence lets users uncover illicit activities and monitor the dark web to determine if their organization is mentioned there. Group-IB's platform gives insight into threat actor activity in the MITRE ATT&CK format. Group-IB Threat Intelligence Platform can be configured with the Unified Risk Platform to automatically detect and take down malicious sites to protect a brand and its customers.^[3]

Group-IB's online fraud protection platform uses global fraud intelligence, device fingerprinting and behavioral analysis to detect fraud. Group-IB device fingerprinting technology is powered by the patented Global ID innovation. Group-IB device fingerprinting identifies devices, generates unique fingerprints, tracks fraudulent activities and uncovers hidden multi-accounting, anti-detection browsers and account farming. Group-IB Fraud Protection's AI uses a combination of signature analysis and User Behavior Analysis (UBA). Group-IB's user behavior analysis covers Typing Dynamics, Touchscreen Interactions, Device Motion, App Usage Patterns and Geoprofiling.^[4]

Group-IB delivers external attack surface management that automatically maps every asset and provides continuous attack surface monitoring and analysis. Group-IB's platform enriches findings with threat intelligence to assess risk and prioritize issues. The Graph tab in Group-IB's attack surface platform visualizes external IT assets and their connections. The Assets tab lists Internet-facing assets that are part of an organization's infrastructure, which can be confirmed or ignored. The Issues tab lists identified issues among confirmed assets, which can be marked as Under Review, Solved, Ignored or False Positive. Group-IB's attack surface platform checks confirmed assets for common vulnerabilities and assigns each one a risk score.^[5]

Group-IB's digital risk protection solution continuously monitors and detects threats across the open, deep and dark web. Group-IB Digital Risk Protection solution implements a three-stage takedown process for violations such as scam and phishing. Group-IB Digital Risk Protection uses machine learning to detect scams, phishing and other violations. Group-IB analysts research scam groups, actors and popular schemes, creating new assets for monitoring and public reports. Group-IB puts 70+ internationally distributed cybersecurity and brand protection professionals at its customers' disposal.

Group-IB delivers anti-phishing solutions and phishing takedown services. Group-IB offers Business Email Protection against phishing and scam attacks. Group-IB Trebuchet is an automated security assessment tool for determining email security posture. Group-IB Managed XDR solution secures an email gateway using intelligence-driven behavioral analysis technology. Group-IB has Anti-Scam and Anti-Phishing modules that keep users informed about violations and brand risks. Group-IB Cybersecurity Courses educate employees about scammers, their behavior, tools and techniques.^[7]

Group-IB offers automated and manual testing of the blockchain network, website and application. Group-IB's crypto security experts provide due diligence against wallets and practices such as encryption, audits and secure storage for hot, cold and hardware wallets.^[5][7][8][9]

About Recorded Future

Recorded Future is a threat intelligence company that sells real-time intelligence and autonomous defense. Recorded Future describes its portfolio as made up of four solutions, one for each domain attackers target. Recorded Future uses the Intelligence Graph to index data from over a million sources, including the open web, dark web, technical feeds, and customer telemetry. Recorded Future states that the Intelligence Graph is accessible via API and powers nine specialized products.^[3][4][5]

The Intelligence Graph connects data points using an ontology graph for stable information and an event graph for rapidly changing threat data. Recorded Future applies analytics such as Recorded Future Risk Scores to the data in the Intelligence Graph. Recorded Future Threat Intelligence provides detailed profiles of the threat actors currently attacking similar organizations and the techniques and tools they use. Recorded Future provides pre-built hunting packages that include YARA, Snort, and Sigma rules written and tested by its Insikt Group. Recorded Future notifies users by email, mobile app, or portal when new relevant intelligence for their organization is identified.^[5][6]

Vulnerability Intelligence scores vulnerabilities based on their exploitability, using real-time data. Vulnerability Intelligence tracks vulnerabilities specific to an organization's tech stack without any agents or sensors required. Recorded Future lets users monitor vulnerabilities by lifecycle stage, from disclosure to exploitation, and alerts them when a vulnerability changes state. Recorded Future SecOps Intelligence uses data indexed across the dark web and other sources to give tactical and operational insights. SecOps Intelligence has out-of-the-box integrations including Microsoft Sentinel, Cortex XSOAR, ServiceNow Security Incident Response, Crowdstrike, and SentinelOne. Geopolitical Intelligence indexes global data from across social media, local news, and messaging platforms in numerous languages. Recorded Future offers Country Risk Scoring to assess the risk of conducting or continuing business in a specific country across security, privacy, and regulatory factors. Recorded Future assesses country risk across five functional categories: Governance & Institutions, Physical Security and Travel, Cybersecurity, Data Privacy and Surveillance, and Supply Chain.^[7][8][9]

Recorded Future supports continuous monitoring of vendors for breach disclosures, ransomware exposure, and dark web activity. Recorded Future supports prioritizing third- and fourth-party risk by business criticality and threat severity. Recorded Future risk scores and evidence can be integrated directly into TPRM and GRC workflows. Recorded Future detects compromised cards and checks using real-time dark web and fraud ecosystem data. Recorded Future can identify at-risk merchants and block fraudulent transactions before losses occur. Recorded Future generates case reports to understand compromised card lineage and fraud campaign context. Recorded Future supports alerting on and acting on stolen credentials within IAM solutions.^[10]

Collective Insights integrates data from security tools like EDR, SIEM, SOAR, and email security. Collective Insights automatically tags security events and maps them to the MITRE ATT&CK framework. The Collective Insights API is free to use with a current Recorded Future subscription. Collective Insights uses read-only API access and only touches detection metadata. Recorded Future describes an API-first architecture with out-of-box integrations spanning SIEM, SOAR, EDR, IAM, Network Security, and Vulnerability Management. Recorded Future integrates threat intelligence directly into key security tools like SIEM, SOAR, and EDR using APIs and automated processes. Recorded Future offers automatic Watch List connectors, such as for Tenable Vulnerability Management and Qualys Vulnerability, that update vulnerability Watch Lists in real time.^[11][12]

Recorded Future describes Autonomous Threat Operations as moving security from reactive analysis to autonomous defense. Recorded Future analysts provide validated incident escalations. Recorded Future services staff continuously monitor vulnerabilities across the weaponization lifecycle and alert on what needs to be prioritized. Recorded Future offers professional services programs including Analyst on Demand, Intelligence Services, and Managed Monitoring. Recorded Future University provides training courses on Recorded Future products and intelligence strategies. Recorded Future states that it is ISO 27701 and SOC2 compliant. INVESTBANK uses Recorded Future to get AI-driven threat intelligence and to streamline orchestration. NOV relies on Recorded Future.^{[1][3][6][7][8][11][12][13]}