Preemptive Cybersecurity

Making You a Harder Target in Cyberspace

Noise-Free Preemptive Threat Intelligence Specific to your Organization

The threat intelligence industry has grown exponentially over the years, but it still fundamentally relies on Indicators of Compromise (IoCs) as a crucial component. Whilst many organizations rely on IoCs, adversaries rarely reuse the same IPs, hashes, or infrastructure to repeat an attack. This gap is often highlighted by Mirza Asrar Baig, Founder and CEO of CTM360. As he puts it:

“IoCs change ten times a day, while TTPs remain the same even in ten years.”

Focusing on IoCs regularly overwhelms security teams due to noise. Rather than focusing on IoCs, CTM360 adopts a TTP-driven intelligence approach that enables organizations to identify and address root causes, reducing the likelihood of successful attacks. By aligning threat intelligence with frameworks such as MITRE ATT&CK, organizations can move beyond reactive detection and use intelligence as a means of risk-based hardening. In addition, organizations can enable a more preemptive approach through Indicators of Exposure, Warning, and Attack.

Indicators of Exposure, Warning, & Attack

"IoCs are about someone else somewhere else, IoWs, IoEs and IoAs are about you and now"

CTM360’s Preemptive Security Model is built around three augmented layers of threat intelligence: Indicators of Exposure (IoEs), Indicators of Warning (IoWs), and Indicators of Attack (IoAs). These indicators shift security teams’ focus from reactive detection to proactive security, enabling them to monitor and take down threats during their early planning stages while remaining specific and relevant to the organization.

Indicators of Exposure (IoEs)

Indicators of Exposure (IoEs) are signs that your organization has “open doors” or weak spots visible from the public domain. These are early entry points that attackers can discover during scanning and reconnaissance stages of an attack. Common examples include misconfigured DNS records, exposed employee credentials, unsecured cloud assets, and other misconfigurations in your attack surface. By proactively identifying and fixing these exposures, security teams can eliminate potential entry points and strengthen the organization’s overall security posture.

Indicators of Warning (IoWs)

Indicators of Warning (IoWs) provide intelligence that someone, somewhere, is putting together some piece of malicious infrastructure to initiate an attack. These indicators are the early warnings of potential attacks, such as newly registered lookalike domains or rogue infrastructure. By acting on these warnings early, organizations can disrupt emerging threats before they escalate into full-scale attacks.

Indicators of Attack (IoAs)

Indicators of Attack (IoAs) signal that there are active threats targeting your organization, such as phishing sites, malicious infrastructure, brand impersonation, CIP impersonation, malicious mobile apps, and more. These indicators provide organizations with relevant actionable threat intelligence while reducing Threat Intelligence Noise (TIN).