Threat Intelligence
Intel tailored to your industry, threat model, and attack surface
What this engagement covers
The service
Strategic and tactical threat intelligence - not vendor feeds repackaged. We produce reporting on threats actually relevant to your business, your industry, and your exposed infrastructure.
What we test
Industry threat landscape, threat actor TTPs targeting your sector, brand and domain impersonation, dark-web exposure, credential leaks, and technology-specific emerging threats.
Scoping & Assessment Depth
Black Box Assessment
Zero-KnowledgeSimulates an external adversary targeting Threat Intelligence with no internal credentials, source code, or architecture documentation. Assesses perimeter exposure, unauthenticated attack paths, and edge resilience.
Gray Box Assessment (Recommended)
CredentialedSimulates an authenticated user, tenant, or insider threat within Threat Intelligence. We evaluate role segregation, authorization boundaries, privilege escalation, and business logic flaws across user tiers.
White Box / Source-Assisted
Full-KnowledgeConducted with direct access to architecture schematics, configuration files, and API/code documentation. Eliminates blind spots and provides exhaustive coverage of security mechanisms governing Threat Intelligence.
Attack Surface & Vulnerability Vectors
Credential pairs exposed on dark web
Rigorous testing and validation to uncover Credential pairs exposed on dark web across your Threat Intelligence environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Brand impersonation campaigns
Rigorous testing and validation to uncover Brand impersonation campaigns across your Threat Intelligence environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Typosquatted domains
Rigorous testing and validation to uncover Typosquatted domains across your Threat Intelligence environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Industry-targeted ransomware groups
Rigorous testing and validation to uncover Industry-targeted ransomware groups across your Threat Intelligence environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Technology-specific zero-days
Rigorous testing and validation to uncover Technology-specific zero-days across your Threat Intelligence environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Leaked source code or proprietary data
Rigorous testing and validation to uncover Leaked source code or proprietary data across your Threat Intelligence environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
How we run it
Dedicated analyst coverage with monthly strategic briefings, weekly tactical alerts, and on-demand threat actor profiling tied to your specific exposure.
Threat landscape scoping to your industry
Rigorous technical execution, boundary verification, and manual exploitation testing targeting threat landscape scoping to your industry across your threat intelligence deployment.
Ongoing collection and analysis
Rigorous technical execution, boundary verification, and manual exploitation testing targeting ongoing collection and analysis across your threat intelligence deployment.
Analyst-produced finished intelligence
Rigorous technical execution, boundary verification, and manual exploitation testing targeting analyst-produced finished intelligence across your threat intelligence deployment.
Tactical indicator distribution
Rigorous technical execution, boundary verification, and manual exploitation testing targeting tactical indicator distribution across your threat intelligence deployment.
Integration with your SIEM/SOAR
Rigorous technical execution, boundary verification, and manual exploitation testing targeting integration with your siem/soar across your threat intelligence deployment.
What you receive
Findings land in your tracker as you go, not only in a PDF at the end. Retest is in scope, not a change order.
- Monthly strategic threat briefing
- Weekly tactical alerts
- Industry-specific threat actor profiles
- Credential leak monitoring
- Brand and domain impersonation tracking
- Technology-specific vulnerability alerts
- On-demand threat actor deep dives
What we usually find
The issues this engagement surfaces most often. Yours will differ, but this is the shape of it.
Who this is for
Auditor-Ready Compliance Crosswalk
| Framework | Control Section | Testing Evidence & Report Deliverable |
|---|---|---|
| SOC 2 Type II | CC4.1, CC7.1, CC7.2 | Technical testing evidence validating system boundaries, access restrictions, and vulnerability identification controls. |
| ISO/IEC 27001:2022 | Control A.8.8 & A.8.20 | Management of technical vulnerabilities and network security verification through independent technical assessments. |
| NIST Cybersecurity Framework | PR.AC, DE.CM, RS.AN | Technical testing verifying access controls, anomaly detection efficacy, and incident response mitigation capabilities. |
Findings are mapped to SOC 2, ISO 27001, NIST CSF, so the report drops into an audit package rather than needing to be translated first. If you need the readiness work behind one of those, that is a separate engagement.
Frequently Asked Questions
Direct answers on scoping, methodology, compliance validation, and deliverables.
Our Threat Intelligence service combines deep manual testing with automated verification. We cover: Monthly strategic threat briefing, Weekly tactical alerts, Industry-specific threat actor profiles, Credential leak monitoring, Brand and domain impersonation tracking. Every engagement includes reproducible proof-of-concept exploits, developer-ready remediation guidance, and a free retest.
Yes. Findings are directly mapped to SOC 2, ISO 27001, NIST CSF control requirements. The resulting report is auditor-ready and formatted for immediate submission to SOC 2 CPAs, PCI QSAs, and enterprise vendor risk assessment teams.
Yes. Every Lorikeet Security engagement includes free retesting within 30 to 60 days to validate that your remediation patches successfully resolve the identified vulnerabilities before your final report is issued.
Typical active testing turnaround is Ongoing monthly service, with critical findings reported immediately via your Talon portal so your engineering team can begin remediation without waiting for the final PDF.
Pricing starts from $3,500/month. We scope the engagement in one call based on your environment's surface area, user roles, and complexity, providing a transparent, fixed-price quote with no hidden change orders.
Scope it in one call
Tell us what is in scope and we come back with a fixed price and a start date. No discovery-call maze, no hourly estimate that moves.
