What is your detection hit/miss rate? What happens when you miss something?
Seems like this is going to become a cat and mouse game similar to evading AV.
Seems like this is going to become a cat and mouse game similar to evading AV.
To your point catching every threat or every alert especially on darkweb is always a cat and mouse game. Our idea is a prioritization problem – how do you mitigate the biggest risks quickly.
The existing OSINT tools we used are keyword search based / pretty noisy so we’ve been focusing on the idea that given there’s no way analysts can find or triage every alert, how do you catch the biggest stuff. We do a few things from AI crawlers to continue to expand data collections to AI categorization, clustering, data extraction etc to make it easier to track the cover the most ground.
OSINT is about gathering data from public or semi-public places.
There are plenty of private dark web forums that these kinds of tools probably don't have visibility into, but the bigger public well-known ones are where you are most likely to see high-profile breaches being sold (since there's a wider audience and actors want to sell data quickly before it devalues), so it's certainly better than nothing...