What we are seeing
Our analysts publish what they find. Advisories and technical notes are free and always will be — if a campaign is running against your sector, knowing about it should not require a contract.
Free, no registration
All advisories- CriticalInvoice-redirect campaign targeting Baltic logistics suppliersCR-2026-0184Logistics
- HighCredential-stuffing infrastructure staged against EU retail bankingCR-2026-0183Financial services
- HighLookalike domain cluster impersonating national e-services portalsCR-2026-0181Public sector
- ModerateCounterfeit storefronts reusing verified merchant identifiersCR-2026-0179E-commerce
Findings public, full PDF by request
All reports- Annual review48 pagesThreat Landscape 2026Twelve months of observed activity across the six regions we cover — who is operating, what they want, and how they get in.
- Sector brief22 pagesInvoice Fraud in European LogisticsHow thread-hijacking operators exploit the structure of freight settlement, and why conventional phishing training does not catch it.
Free, never gated
All notes- 7 minDetecting thread hijacking without reading anyone's mailHeader and graph signals that identify an injected reply, without content inspection or the privacy problems it brings.
- 6 minWhat we preserve first, and why the order mattersThe evidence acquisition sequence our responders follow in the first hour, and the reasoning behind it.
- 5 minp=quarantine is not enforcementWhy a partial DMARC policy provides far less protection than the dashboard suggests, and what the percentage tag actually does.
Most of our work will never appear here.
Fifty-seven investigations carried to conclusion. Write-ups are published only once the client has approved the wording and no active proceedings are prejudiced — which usually means a year or more after the work ends.
How we run investigationsGet advisories before they are public
Customers receive sector advisories ahead of publication, with the indicators and detection logic attached. It is included in every platform subscription.
30 min
A scoping call, with an engineer rather than a sales rep.
What it costs
Nothing, and there is no sequence afterwards. If we are not the right fit we will say so and suggest who is.
Under attack now?
Do not use this form. The hotline is answered around the clock and reaches a duty analyst directly.