Group-IB vs iCOUNTER

About iCOUNTER

In real time, iCOUNTER detects the active threats targeting a customer's vendors, suppliers, MSPs, SaaS providers, partners, and broader digital ecosystem.

An acceptable security posture can coexist with stolen credentials, access for sale, or an active compromise. Enterprise systems now depend on vendors, SaaS providers, and other third parties that third party risk management programs cannot continuously monitor.

CTOS (Counter Threat Operating System) is a cybersecurity platform that connects intelligence collection, risk determination, enterprise context, and counter-threat operations in one architecture. CTOS identifies active threats across a customer's extended ecosystem, determines their relevance to the business, and drives remediation with the affected third party. CTOS identifies adversary targeting, exposed credentials, campaign staging, and active compromise signals. Example threats include network or administrator access for sale, compromised VPN credentials, web shells, and data appearing in ransomware files. Active targeting and compromise signals are identified across critical third parties, technology providers, supply-chain partners, and subsidiaries. The Counter Threat Operating System (CTOS) includes third-party risk management and counter fraud capabilities.^{[1][5][9][10]}

CTOS combines global intelligence collection with a digital twin of the customer's ecosystem to determine which live threats matter to that customer. Intelligence collection across thousands of global sources, including cybercrime forums, credential markets, and ransomware sites, is owned and operated by iCOUNTER. Signals are collected continuously from adversary infrastructure, active compromise activity, exposed credentials, dark web sources, and third-party ecosystem telemetry. HUMINT is augmented with AI parsing of hundreds of databases to identify specific targeted threats. CTOS correlates threat signals against a digital twin of the customer's ecosystem to help determine whether a threat is real, which third parties are affected, the potential business impact, and who needs to act. CTOS determines risk at the Edge of Intelligence Collection, validating threat signals against the customer's ecosystem before findings reach the customer's team. CTOS connects third-party relationships and business dependencies to the organization's risk framework and tiers. AI helps CTOS correlate large volumes of threat signals and determine which are relevant to the customer's ecosystem. CTOS connects validated risk to existing security and risk workflows, and feedback from remediation outcomes informs the intelligence operation.^[6]

Using observable connection data, iCOUNTER maps a customer's ecosystem of vendors and data flows. Early warning is given if access to a vendor's network has been gained by cybercriminals. Vendors that have been victims of successful ransomware attacks, or that have exposed data that may include the customer's, are identified.^[6]

On the customer's behalf, iCOUNTER runs the intelligence-to-remediation operation: collecting and validating signals, determining ecosystem risk, engaging affected third parties, and coordinating remediation through completion. Under its terms, iCOUNTER provides managed third-party threat detection and response services that perform continuous reconnaissance across the customer's extended third-party ecosystem using human intelligence, technical intelligence, and adversary infrastructure monitoring. The managed services include a Validated Connectivity Inventory, which enumerates third parties based on verified bi-directional data exchange. Prescriptive Remediation provides actionable countermeasures with defensible evidence for third parties to take corrective actions. Analysts at iCOUNTER manage the CTOS Platform to track risk events, communicate with impacted third parties, and track third-party mitigations. Customers get access to the CTOS Platform for monitoring risk events, communications, and mitigations. Quarterly Business Reviews summarize alerts, mitigations, and current risk profile. Remediation is handled by iCOUNTER, which engages the affected third party, coordinates remediation, and tracks the fix to completion with evidence. Built-in metrics and remediation tracking are used to communicate progress to stakeholders and the board. The Managed Services and the CTOS Platform dashboard are provided by iCOUNTER, Inc.^[5]

CTOS complements a customer's existing program, including security ratings, questionnaires, GRC, threat intelligence, and SOC tools. Alongside a SecurityScorecard program, iCOUNTER adds its own intelligence collection, business-specific risk determination, and managed third-party response. A direct integration with SecurityScorecard is not required to begin an iCOUNTER engagement. Any data exchange or workflow integration can be scoped separately around the customer's environment and the products the customer uses. To start, a customer supplies a CSV of priority third parties and ecosystem partners. Customers share their risk framework, priorities, and current service coverage so the engagement can focus on relevant business dependencies. CTOS is aimed at CISOs, third-party risk managers, security operations teams, and compliance officers in enterprises and public sector organizations with complex third party ecosystems.^[8]

John Watters acquired iDEFENSE in 2002, four years after its founding in 1998, and later founded iSIGHT Partners in 2007. Following the merger of iSIGHT and Mandiant under the Mandiant brand, John Watters served as President and COO until the company's acquisition by Google in 2022.^{[5][6][8][9][10][11]}