Cyber Adversary Intelligence

Get faster detection of cyber compromises with a higher degree of accuracy

How It Works

What is Cyber Adversary Intelligence?

Cyber Adversary Intelligence is high fidelity telemetry data collected directly from an attacker’s own infrastructure, giving you significant advantages over other cyber intelligence sources:

See cyber attacks in the early stages
Confirm precisely which IP addresses and organizations have been attacked, exactly when it occurred (and for how long), the specific malware used, and which threat actor is behind it
Detect cyber compromise activity faster and with a significantly higher degree of accuracy than traditional methods, such as IoCs

EVIDENCE OF COMPROMISE

APEX™’s Adversary Intelligence is Proof of a Real
Compromise, Not a Theoretical Indicator (IoC)

Alert investigations have dropped to their lowest level in four years, at below 48%*.

Indicators of Compromise (IOCs) are prone to false-positives and noisy alerts that slow down incident response.

Alert fatigue is a major issue. The number of organizations that receive 100,000 or more daily alerts grew from 11% in 2017 to 17% in 2020.*

Many organizations use automation and tools to analyze and prioritize alerts, but too many important incidents go uninvestigated.

*Cisco CISO Benchmark Study, 2020

Get Early Evidence of a Confirmed Attack

Prevailion automates the identification of confirmed compromises through its high fidelity signal and by collecting victim telemetry directly from the adversary.

This adversary intelligence, available via a subscription to the APEX™ Platform, delivers actual evidence of a compromise, instead of a theoretical indicator, allowing companies to quickly remediate attacks while they are still in the early stages.

“When I see compromise activity in the APEX™ platform, I have absolute confidence that it’s something of concern. I am able to save a lot of time by quickly checking my most critical environments.”

-Greg Akers, Technology Executive & Former Senior Vice President of Cisco Systems

How it works

How Prevailion Collects Cyber Adversary Intelligence

Our proprietary technology infiltrates threat actors’ networks in order to intercept covert communications between the hackers and their malware.

We then capture leads from the C2 (Command and Control) and heavily vet them for confirmed activity used by threat actors for ongoing malicious operations

APEX™ continuously monitors and collects telemetry on these confirmed threats

Our analysts vet and clean the collected data to deliver the highest confidence adversary intelligence in our APEX™ Platform

READ HOW APEX™ WORKS

Adversary Intelligence Collected in APEX™ Platform Over the Last 180 Days

60B

Malicious Beacons

540K

IP Addresses

220

Malware Families

Prevailion’s data collection is continually expanding. During the first half of 2020, the total number of tracked IP addresses grew by 300%.

The APEX™ Platform includes rich telemetry detail on confirmed cyber compromises:

Compromise severity level (Severe, Critical, Elevated, Stable)
Malware and threat type
Threat actor attribution
Time window (Dwell Time)
First beacon seen timestamp
Last beacon seen timestamp
Beacon counts (Frequency, Velocity and Cadence)
GEOIP intelligence helps you quickly pinpoint the location of compromise activity to aid in operations and investigations
Downloadable enriched telemetry related to victim organizations to expedite response and remediation

See Actual Cyber Compromises, Not Just Vulnerabilities

Sign up now to get a guided tour and free account to check the compromise status of your own organization and up to 10 supply chain partners for free in the APEX™ Platform.

Cyber Adversary Intelligence

See cyber attacks from the vantage point of threat actors

Get faster detection of cyber compromises with a higher degree of accuracy

What is Cyber Adversary Intelligence?