Capabilities Core Services

We Do It

Vector Brief

“Intel and Hunt, matched to your stack. Recon coming soon.”

Available Now

Tell us what you run and who runs it for you. We will match you to the right tier and start with a 90-day look-back hunt.

What It Is

Intel. We sweep vendor advisories, national CERTs, independent researchers and exploitation telemetry every day, and publish only what is real and new. Our free public Threat Brief is posted periodically for anyone and covers the biggest stories in the news cycle and active campaigns; it is not matched to any one stack or setup. A Vector Brief subscription is: it delivers at least weekly, and often daily when something real lands, and every item is matched to the technology you actually run, so you see the few things that apply to you, with what to do now, who can safely skip it, and the indicators to look for. A quiet stretch is reported as quiet, never padded.

Recon (coming soon). We will take a passive outside look at the internet-facing domains and address ranges you name, using public internet-scan data, certificate records and DNS, and check them against the latest intelligence. No traffic will be sent at your systems.

Hunt. For every item that matches your stack, we write a hunt pack — ready-to-run searches for your logging and endpoint tools in Sigma, KQL, Splunk SPL, Elastic ES|QL, osquery and more — and send it to your MDR, MSP or SOC provider as a ticket. Your provider runs it in your environment; we read the results, validate them, and tell you what they mean. We never log into your systems or hold your passwords.

Teams with their own tools can pull everything automatically: a read-only TAXII 2.1 feed of STIX 2.1 objects for platforms such as Microsoft Sentinel, Elastic, QRadar, Cortex XSOAR and OpenCTI; block lists for firewalls; JSON, CSV and a MISP feed; and signed webhooks for your automation. Everyone gets a private portal with the latest report, behind multi-factor sign-in with an authenticator app or a security key, never a text message.

Read more: The free Threat Brief · The PIVCCERL™ Lifecycle

Your provider does the hands-on work in your environment either way; Vector Brief tells them what to look for and checks what they find. Pricing depends on the tier and the number of client profiles, and we share it on the first call.

Who It’s For

  • Small and midsized businesses whose MDR, MSP or SOC provider should be looking for the right things
  • IT and security teams who want only the intelligence that applies to their stack
  • MDR, SOCaaS and MSSP providers who want tailored intelligence and hunt packs for every client they protect
  • Teams with a SIEM, SOAR, XDR or threat intelligence platform that should take the feed in automatically

How We Approach It

  • A stack profile at onboarding: the products and platforms you run, and nothing more
  • A 90-day look-back hunt at onboarding, so you start from a known position
  • A watch report in your portal at least weekly, often daily, matched to your stack
  • Hunt packs sent to your provider as tickets, with every result validated before we call it clean or compromised
  • Recon (coming soon): a passive outside look at the internet-facing assets you name, with no traffic sent at them
  • Machine delivery: TAXII 2.1 and STIX 2.1, firewall block lists, JSON, CSV, MISP and signed webhooks
  • Three tiers: Intel (the brief, the feed and the portal), Hunt (Intel plus hunts ticketed and validated; Recon is added to this tier when it launches), and Providers (Hunt for every client profile under one provider)

Why Threat Vector Management

We built and run the research behind our free public Threat Brief, which we post periodically: every indicator comes from a named source, every hunt pack says what a hit means and why a clean result is a good sign but not an exoneration, and every figure is checked against its primary source before it ships. We have built and led managed detection and response practices from inside the vendors, so the tickets we send your provider are ones an analyst can act on.

Start the Conversation

Other Capabilities