Use cases

Cybersecurity service providers

Find which customer credentials, data and systems are exposed and what an attacker could do with them. Prioritise the exposures your team can close before they lead to an incident. Use the Cyber Exposure Service Proposal to show the client how the work you recommend reduces those risks, with evidence for each recommendation and a result you can both verify.

Bring your assessment process and report template into your CIH-connected AI assistant. Set the scope, reporting period and questions for each customer, and deliver the assessment in your own format and brand. When a customer asks about a subsidiary, an identity or a recurring exposure, follow up against that customer’s evidence in the same conversation. Ongoing monitoring shows what has newly appeared or returned.

Threat intelligence and hunting

Decide which adversary behaviour is worth hunting in the environment you defend. Follow an actor’s handles, access offers, targeted technologies and reported techniques across dated CIH material. An industry-wide campaign, an offer of access to a particular service and a direct reference to your organisation each give the hunt a different scope.

Take the supported behaviour, identifiers and time window into your identity, endpoint or network telemetry. That gives the hunt team a hypothesis to test and a way to identify where its own detection coverage is thin.

Attack surface and penetration testing

Discover the domains, hosts and services your organisation exposes to the internet. Confirm which belong to you and build an inventory that includes assets missing from your own records. Then use evidence of exposed access, leaked credentials or known vulnerabilities to decide what to secure first and where a penetration test would be most useful.

Use the confirmed inventory to agree with the client which assets and access paths the penetration-testing team is authorised to test.

Incident response

During an incident, the first internal alert rarely tells you the full extent of the exposure. Search the affected organisation’s domains, accounts and known indicators for earlier targeting, compromised credentials, actor infrastructure and leaked information. Compare the dates with internal logs to identify possible entry points and additional accounts or systems to examine.

Use those leads to prioritise containment, decide which credentials or sessions need attention, and assess what data may have left the organisation. As new evidence appears, update the incident scope and the recovery work still required.

Law enforcement

Investigate the people and criminal networks behind illicit activity. Search a handle, email address, domain or distinctive phrase across criminal forums, markets and messaging sources. Trace reused identifiers to associated accounts, infrastructure, advertisements and potential victims.

Retain the passages and dates that support each connection. Investigators can link leads across cases, identify victims who may need notification, and give a partner agency or prosecutor a specific line of enquiry to corroborate.

Corporate investigations

Determine whether an allegation of fraud, insider disclosure or a concealed business relationship is supported. Examine what was offered, who used the identifier, when it appeared and which entity the material concerns. Compare those external records with the organisation’s transaction, access or personnel records.

The investigator can narrow the internal review to the relevant period and people, identify who needs to be interviewed, and give counsel a documented account of supported facts and open questions.

Brand protection and fraud

Identify where criminals are using a brand, which customers they approach and what they ask those customers to do. Lookalike domains, impersonation material and payment instructions give the fraud team concrete leads to validate. Use the observed method to target a customer warning or prepare the supporting material for a removal request.

Intellectual property and trade secrets

Trace a project name, filename or distinctive passage from a confidential document to where it appeared. Inspect what a third party displayed, when it was visible and how the source described it. Counsel and the rights holder can compare it with their own records, determine what warrants preservation and focus further investigation on evidence of actual disclosure.

M&A and cyber due diligence

Assess an acquisition target’s cyber risk on its own and relative to comparable companies. Examine the nature, severity and recurrence of exposure across the target’s operations. Compare peers over the same period and account for differences in coverage, so a larger collection of records does not automatically imply greater risk.

Use the material exposures to identify vulnerable operations, estimate the remediation or integration effort, and decide which disruption scenarios belong in the deal model. The buyer can then test the assumptions behind its valuation.

Investment and portfolio risk

A portfolio can be diversified by industry and still depend on the same service provider, carrier or infrastructure. CIH intelligence helps investment analysts examine material exposures across holdings and peers, identify common dependencies, and distinguish a company-specific event from a risk shared across positions.

Use the supported operating impacts to stress-test assumptions about earnings, cash flow and potential loss. Portfolio managers can bring that evidence into decisions about position size, hedging or rebalancing when downside risk is concentrated.

Insurance underwriting and risk reduction

Assess the cyber risk being transferred. A broker can substantiate the applicant’s exposure and remediation with the carrier. An underwriter can compare exposure across similar risks and assess how compromised accounts, vulnerable systems or recurring disclosures could affect loss frequency and severity. That evidence informs pricing, terms and renewal.

During the policy period, use the insured’s findings to direct cybersecurity services from the insurer’s portfolio toward the risks most likely to cause harm. Review subsequent exposure with the insured to see what has been addressed and what still requires mitigation.

Insurance claims and loss adjustment

After an incident, establish which systems, data and business operations were affected, how long the interruption lasted and which exposures still need attention. CIH’s external evidence and chronology help the claims team scope the event alongside the insured’s records and the responders’ findings.

Loss adjusters use that scope to evaluate damage and the resources needed for containment, remediation and restoration. The affected services, recovery work, interruption records and actual costs give the insurer a basis for assessing the size of the loss and allocating specialist support.

Third-party risk and compliance

Document the cyber due diligence performed on critical suppliers. Use an authorised assessment to examine the supplier’s external exposure against the scope and review period required by your third-party risk programme. Apply comparable criteria to similar suppliers and repeat the assessment when policy, a material change or a renewal calls for it.

The findings give compliance teams a record to put alongside the supplier’s response, remediation commitments and any accepted exceptions. At audit or reassessment, they can show what was checked, what remained open and what changed.

Supply chain and business continuity

Assess whether disruption at a supplier threatens an operation you depend on. Identify the entity, facility or route named in the intelligence and compare it with your actual dependency, inventory coverage and recovery window. That narrows what to confirm with the supplier and helps operations teams decide whether to reroute shipments, use alternate capacity or activate a continuity plan.

Defence intelligence

Assess adversary activity against the organisations, technologies and supply routes a mission depends on. Criminal-market activity, offers of access and dated actor reporting can expose interest in a defence supplier or a logistics dependency that merits further collection.

Connect the observed activity with the mission it could affect. Brief the commander on what the adversary has demonstrated, which dependencies warrant protection, and which indicators would signal a change in capability or intent.

Policy and strategic risk

Assess how cybercrime, economic disruption or regional escalation could affect an essential service, strategic industry or trade corridor. Trace a development to the affected organisations and compare it with earlier reporting to establish what has materially changed.

Use that assessment to identify which operators or agencies need to coordinate, which dependencies merit protection, and what evidence would justify changing course. A policy advisor can specify the indicators to monitor and distinguish observed effects from consequences that remain plausible.