Threat Monitoring
Fewer alerts. The right ones, verified.
Our watch floor monitors the open, deep and dark web for threats to your people, facilities, data and brand. Every alert is checked by an analyst before it reaches you, and anything critical reaches you within 60 minutes, day or night.
- Coverage
- 24/7 watch floor with analysts across 14 time zones
- Escalation
- Critical threats escalated within 60 minutes
- Onboarding
- Live within 10 business days
- Team
- Named lead analyst supported by the watch floor rotation
- Deliverable
- Verified alerts, weekly digest and monthly threat review
- Pricing
- Annual subscription scoped to the assets and people covered
When to call us
What we watch for, around the clock.
Monitoring is scoped to what you need protected, not to a generic keyword list. These are the categories most of our monitoring clients cover.
Threats to people
Direct and veiled threats, fixation and hostile interest in executives, staff and their families, assessed for intent and capability.
Facilities and events
Planned protests, calls to action and incidents near your sites, offices and events, with location context from public posts.
Leaked credentials and data
Your domains, documents and customer data on paste sites, breach forums and markets, verified before you are told.
Brand impersonation
Lookalike domains, fake apps, impersonating accounts and phishing kits that borrow your name to defraud customers.
Activism and campaigns
Organized campaigns against your operations, suppliers or leadership, tracked from first mention to mobilization.
Access for sale
Offers on criminal forums to sell access to your network, or requests seeking insiders at your organization.
What you receive
Every alert verified, rated and actionable.
Automated feeds pass along everything they match. Our analysts read the raw matches first, discard the noise and send you only what matters, with a severity rating and a recommended action.
- Alerts verified by an analyst, with the source captured and hashed
- A severity rating and recommended action on every alert
- Critical alerts by phone to your designated contacts within 60 minutes
- A weekly digest of lower-severity activity and emerging trends
- A monthly threat review with your named lead analyst
- A direct step-up to a full investigation when a threat needs a name
How it runs
Tuned before go-live, reviewed every month.
Most monitoring fails in the first month, buried under false positives. We tune detectors against historical data before you receive a single alert.
-
01 / Scope
Week 1
We agree the people, assets, brands and locations covered, the escalation thresholds and who we call, at what hour, for what.
-
02 / Tune
Weeks 1 to 2
Detectors are built and tested against 90 days of historical data, so noise is removed before go-live rather than after.
-
03 / Watch
Ongoing, 24/7
Continuous collection with analyst verification. Critical threats are escalated within 60 minutes, at any hour.
-
04 / Review
Every month
Your lead analyst reviews trends, adjusts detectors as your exposure changes and recommends any follow-up investigation.
Tradecraft
Coverage built by analysts, not keyword lists.
Good monitoring is an intelligence discipline. These are the methods that let us see threats early and keep false positives low.
- Analyst-tuned detectorsNames, nicknames, misspellings, transliterations, product terms and logo matches, refined continuously against what analysts actually escalate.
- Closed-community coverageFringe forums, criminal markets and channels observed through vetted research personas that never engage or provoke.
- Lookalike domain detectionNew registrations, certificate issuance and typo variants of your domains, checked for live phishing content.
- Location-aware monitoringPublic posts, imagery and event listings around facilities and venues, correlated with your operational calendar.
- Exposure verificationClaimed leaks checked against structure, freshness and prior breaches, so you hear about new exposure and not recycled data.
- Threat assessment on escalationFixation, specificity, capability and signs of movement toward action, assessed by trained analysts before an alert is rated.
- Multilingual coverageNative-language analysts in 41 languages read the threats that keyword translation would miss or misjudge.
- Evidence on every alertEach escalated item is captured and hashed at collection, so it remains available after the author deletes it.
Results
From signal to action.
Monitoring is only valuable if it changes what happens next. When an alert needs a name, our investigators take it from there.
Consumer brands
From anonymous threats to a name in 36 hours
Escalating threats against a chief executive came from throwaway accounts. A reused image and a careless upload led to the person behind them.
Our old tool sent us four hundred alerts a week. Aldervane sends three or four, each one checked and each one with a recommendation. My team finally reads every alert we receive.
Questions
Threat monitoring FAQ
How is this different from a monitoring tool?
A tool sends you every match. We send you only what an analyst has read, verified and rated, with a recommended action. You can still see the volume behind it in your workspace, but your team does not have to wade through it.
What counts as critical?
You decide with us at scoping. Typically it covers credible threats of violence, exposure of a principal's location or travel, confirmed new data leaks and active fraud using your brand. Critical alerts are escalated by phone within 60 minutes, at any hour.
Do you monitor our employees?
No. We monitor public sources for threats directed at your organization, not the private lives or personal accounts of your staff. Where a threat involves an insider, we stop and agree next steps with your legal team before doing anything further.
How do you keep false positives low?
Detectors are tested against 90 days of historical data before go-live, and every match is read by an analyst before it is escalated. Detectors are then reviewed monthly against what was escalated and what was discarded.
Can an alert become an investigation?
Yes. Monitoring clients can step any alert up to a full investigation at pre-agreed rates, and the evidence already captured transfers directly to the investigation team.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.