Perspective Intelligence

Home of #ThreatLens - Our OSINT powered attack surface intelligence platform. Protect your companies reputation today at

[Perspective Intelligence @PIntelligenceUK]

See what our Founder, @AaronCTI has to say about #ThreatLens 👇

[Aaron Roberts @AaronCTI]

https://t.co/VjDmJrfrAc

[Perspective Intelligence @PIntelligenceUK]

The strongest impersonation attempts often borrow real company details.

Hiring, events, supplier changes, leadership updates, and product launches can all become pretext fuel.

The issue is not visibility. It is believable misuse.

[Perspective Intelligence @PIntelligenceUK]

Exposure reporting should not just answer: "What was found?"

It should answer: "What decision does this support?"

Block, monitor, brief, accept, escalate, or investigate.

That is the layer that turns collection into intelligence.

[Perspective Intelligence @PIntelligenceUK]

Stale breach data can become fresh phishing context.

The password may be dead. The account trail, role, supplier clue, or naming pattern may still help someone build a better pretext.

That is why credential exposure needs context.

[Perspective Intelligence @PIntelligenceUK]

Old leaked credentials can still matter even when the password no longer works.

They can reveal naming patterns, forgotten accounts, shadow SaaS, personal email use, and context that makes phishing more believable.

Exposure is not always binary.

[Perspective Intelligence @PIntelligenceUK]

Executive exposure is not just a visibility issue.

It can become a leverage issue.

The important question is not:

"What is public?"

It is:

"What could someone do with it?"

That is the difference between passive exposure and real targeting risk.

[Perspective Intelligence @PIntelligenceUK]

A lookalike domain is not dangerous because it exists.

It is dangerous because of what it makes believable.

- A Supplier Payment Request
- A Fake Portal
- A Credential Prompt
- An Executive Impersonation

That is where the real risk sits.

[Perspective Intelligence @PIntelligenceUK]

The updates to ThreatLens keep coming, and we are regularly identifying and helping businesses to reduce their risk exposure. This thread highlights some of the recent feature updates!

[Aaron Roberts @AaronCTI]

Been incredibly busy with ThreatLens development recently, but a couple of the newest things we've added. Firstly, intel findings based on broad recon scans across a domain.

[Perspective Intelligence @PIntelligenceUK]

A fake login page is not just a phishing page.
If captured and reviewed properly, it can reveal:
- Who Is Being Impersonated
- Who Is Being Targeted
- What Credentials Are Being Sought
- Whether It Links To A Wider Campaign
Takedown removes the page but doesn't explain the risk.

[Perspective Intelligence @PIntelligenceUK]

More findings are not the goal.

Better decisions are.

That is the difference between a noisy external scan and useful external exposure intelligence.

[Perspective Intelligence @PIntelligenceUK]

A finding is not intelligence until someone can act on it.

External exposure creates lots of raw signals. The hard part is turning them into decisions.

[Perspective Intelligence @PIntelligenceUK]

Automation can collect and triage at scale.

Human analysis adds context, confidence, evidence, and prioritisation.

That is what turns collection into intelligence.

[Perspective Intelligence @PIntelligenceUK]

3 potential cyber incidents identified in just a few weeks.

ThreatLens helped companies across 3 different industries detect risks early and take action before they escalated.

The best defence is spotting threats before they become incidents.

Start your ThreatLens trial today

[Perspective Intelligence @PIntelligenceUK]

A phishing page is rarely just a page.

It can signal brand abuse, credential targeting, infrastructure reuse, campaign timing, and who an attacker thinks is worth impersonating.

The real question is not only ‘does this exist?’ but ‘what does this tell us?’

[Perspective Intelligence @PIntelligenceUK]

Attackers do not just exploit exposed systems.

They exploit exposed trust: impersonation, leaked credentials, lookalike domains, executive details, public company context, and reused brand assets.

If a view only sees infrastructure, it misses what makes attacks believable.

[Aaron Roberts @AaronCTI]

How do hackers view YOUR business from the outside? Here's my approach to mapping your external attack surface using OSINT - from exposed creds to vulnerable infra.

Most orgs have no idea what's actually visible to attackers. So let's see what we find in a typical job. 🧵

[Aaron Roberts @AaronCTI]

OSINT professionals - What's the one tool you wish existed but doesn't yet?

I'm collecting ideas for ThreatLens development and want to know what would actually make your investigations easier. Not the flashy stuff, the real gaps in your workflow.

Drop your answer below and I'll share the results next week.

[Aaron Roberts @AaronCTI]

Happy Easter weekend, but more importantly #OSINTToolsThursday is here! Let's dive into the OSINT, CTI and CBRN(?!) tools we've looked at this week!

[Aaron Roberts @AaronCTI]

Is this your favourite time of the week if you're an OSINT analyst? It should be! It's time for #OSINTToolsThursday 🥳

[Aaron Roberts @AaronCTI]

Same Bat Time. Same Bat Channel. It's time for #OSINTToolsThursday! Let's see what's been cooking for new OSINT tools this week shall we?