Why CIH

CIH began in Singapore in 2015 as an intelligence collection contractor for defence and law enforcement agencies. The team behind CIH helped build early dark web search engines and contributed to the development of the Tor protocol.

Many of those investigations involved private companies, their systems and their data. CIH extended its work to cybersecurity providers and other professionals assessing those risks in the private sector.

CIH collects directly from criminal marketplaces, forums, messaging channels, breach releases, leak sites and logs from information-stealing malware. A marketplace offer shows what a seller advertised. A breach release or malware log can show the actual data involved. Your team can examine both without maintaining access to each source itself.

In CIH’s early years, analysts searched the dark web by hand. They learned which sources were worth returning to and what material to collect. They also classified what they found, assessed its severity and considered what it could mean for the organisations involved.

That experience shaped how CIH automated the work. The team wrote scripts to handle routine collection, introduced machine learning to classify findings and later applied AI to analysis and reporting.

Eleven years of collection give CIH a point of comparison when something surfaces today. Data offered for sale this morning may contain records our analysts first saw years ago. Comparing the two helps establish what has resurfaced and what the latest offer adds.

CIH has worked with NATO, INTERPOL and the United Nations Office on Drugs and Crime. INTERPOL partnered with CIH to support investigations into cybercrime and the criminal use of virtual assets. The UN office drew on CIH’s dark web data for its assessment of darknet threats in Southeast Asia.

CIH worked with the National University of Singapore on the Cyber Exposure Index, which compares cyber exposure across publicly listed companies. The university’s Centre for Research in Privacy Technologies and CIH collaborated on how to measure exposure across industries.

CIH has supported academic research over the years, including work by master’s and doctoral students. In finance, researchers at the University of North Carolina at Chapel Hill and Macquarie University used CIH data to study trading before companies publicly disclosed a breach. Related research at Singapore Management University examined how hacktivist campaigns affected financial institutions.

A team including researchers at Tampere University and Delft University of Technology drew on CIH’s collection to study which accounts infostealer malware exposed and how often victims reused credentials. CIH also contributed to research on identifying illicit marketplace activity and supplied data for a study by researchers at the University of Technology Sydney and Ghent University on how well language models recognise illicit sales.

Hoxhunt partnered with CIH to bring cyber exposure intelligence into employee security awareness training. Gartner covered CIH in its research on digital risk protection services. Forrester included CIH in its landscape of external threat intelligence service providers.