Know what hunts you
Threat modeling is an old idea wearing technical clothes. Know what you protect. Know who
hunts it. Learn how they move. Then see them coming.
ProtectName what you hold that someone else would want. Most defenses fail here, before any attacker shows up.
IdentifyAdversaries are not weather. They are groups with habits, tooling, and preferred prey. They can be studied.
TrackEvery intrusion leaves spoor. Techniques repeat long after the infrastructure that carried them is gone.
AnticipateA studied adversary becomes predictable. The point is not to read about the attack. It is to be standing where it lands.
Indicator lists age like tracks in the rain. An IP address dies in a day, a file
hash even faster. Behavior is what holds, so behavior is what we profile: techniques mapped to
MITRE ATT&CK, weighed for durability, scored for confidence.
How the intel is made
Everything here starts in the open. Vendor research, government advisories, leak sites,
honeypot telemetry from our own sensors in the field. No feeds you must buy, no claims you
cannot check.
Each adversary is worked into a structured brief. Claims branch across independent sources and
only converge when the sourcing survives scrutiny. Single-vendor stories are marked as exactly
that until a second, genuinely independent source exists. Confidence is stated, and what we do
not know is written down next to what we do.
Then a human reads it and signs it. Every brief that leaves this shop carries a named,
hash-bound confirmation in an append-only ledger. If the content changes after review, the
record says so loudly. Machines draft here. People attest.
Where it becomes usable
Confirmed work flows to OSCIRA, the governed side of the house. OSCIRA takes what the
hunt brings in, holds it to its own standard of review, and turns it into an actor knowledge
base built for defenders, including ActorAtlas, the reviewable record of everything
that has been governed.
Two shops, one discipline. Jagter produces and confirms. OSCIRA governs and
serves. Neither publishes what the other has not earned.
Visit OSCIRA
