Cyber Adversary Intelligence

Cyber Adversary Intelligence is high fidelity telemetry data collected directly from an attacker’s own infrastructure, giving you significant advantages over other cyber intelligence sources:

• See cyber attacks in the early stages
• Confirm precisely which IP addresses and organizations have been attacked, exactly when it occurred (and for how long), the specific malware used, and which threat actor is behind it
• Detect cyber compromise activity faster and with a significantly higher degree of accuracy than traditional methods, such as IoCs

APEX™’s Adversary Intelligence is Proof of a Real
Compromise, Not a Theoretical Indicator (IoC)

Alert investigations have dropped to their lowest level in four years, at below 48%*.

Indicators of Compromise (IOCs) are prone to false-positives and noisy alerts that slow down incident response.

Alert fatigue is a major issue. The number of organizations that receive 100,000 or more daily alerts grew from 11% in 2017 to 17% in 2020.*

Many organizations use automation and tools to analyze and prioritize alerts, but too many important incidents go uninvestigated.

*Cisco CISO Benchmark Study, 2020

Get Early Evidence of a Confirmed Attack

Prevailion automates the identification of confirmed compromises through its high fidelity signal and by collecting victim telemetry directly from the adversary.

This adversary intelligence, available via a subscription to the APEX™ Platform, delivers actual evidence of a compromise, instead of a theoretical indicator, allowing companies to quickly remediate attacks while they are still in the early stages.

How Prevailion Collects Cyber Adversary Intelligence

The  APEX™ Platform includes rich telemetry detail on confirmed cyber compromises:

• Compromise severity level (Severe, Critical, Elevated, Stable)
• Malware and threat type
• Threat actor attribution
• Time window (Dwell Time)
• First beacon seen timestamp
• Last beacon seen timestamp
• Beacon counts (Frequency, Velocity and Cadence)
• GEOIP intelligence helps you quickly pinpoint the location of compromise activity to aid in operations and investigations
  Downloadable enriched telemetry related to victim organizations to expedite response and remediation