Human Intelligence (HUMINT)
Where software can't go, we do. Long-standing analyst identities inside closed criminal communities, gathering signals on operations targeting your sector — sometimes months before the first attack.
The work, defined.
Where automated tools — and even our dark web monitoring service — can't go (vouched-entry forums, invite-only channels, ransomware affiliate panels, initial access broker private groups), that's where HUMINT operates. Long-standing analyst identities, built over years, with native-language tradecraft.
This is strategic intelligence. We don't sell you 'alerts.' We sell you advance warning of operations targeting your sector, profiles of threat actors who may be eyeing your industry, TTPs being developed in private, and access to conversations that affect your risk landscape.
Most clients use HUMINT alongside dark web monitoring. Dark web monitoring tells you when your data shows up. HUMINT tells you when your sector is being scoped.
How we do it.
Long-standing identities
Our analyst identities have been members of closed communities for years — vouched in by trust, sustained by tradecraft. Source protection is paramount; we don't burn access for short-term wins.
Targeted collection
We work to your priorities — sector, region, threat actor, TTP focus. Collection is scoped, not generic.
Strategic synthesis
Monthly threat-actor briefings. Pre-attack indicator reports. Sector-specific intelligence assessments. Written by senior analysts, briefed by leadership.
Source protection
Reports are sanitized. Sources are not exposed. You get the intelligence; we keep the access.
What gets covered.
What you get.
Every engagement includes the deliverables below. Custom outputs available on request.
- Monthly threat-actor briefing (PDF + 60-min call)
- Pre-attack indicator reports (ad-hoc)
- Strategic sector assessments (quarterly)
- Custom collection on request
- Source-protected raw intelligence (when appropriate)
- Annual threat landscape forecast
A regional utility engaged Beralock HUMINT for ongoing visibility into ransomware affiliate activity. Our analysts identified planning conversations in a closed channel — TTPs, target shortlist, expected timing — for an attack on Southeast Asian utilities.
47 days advance warning. The client deployed targeted defenses, hardened the specific attack vectors discussed, and shared anonymized intelligence with regional CERTs. The attack proceeded against a different target. Our client was not impacted.
Details adjusted to protect client identity. Verified case studies available under NDA.
Other services.
Dark Web Monitoring
Long-standing analyst identities in 200+ closed forums, marketplaces, and channels. When your credentials appear, you know — often before the buyer logs in.
Brand Monitoring
Cloned domains, phishing kits, fake profiles, and counterfeit listings — found across surface, deep, and dark web, then removed end-to-end.
Executive Monitoring
Your leaders are the highest-value targets in your company. We monitor doxxing channels, impersonation profiles, and coordinated targeting — and shut it down before it escalates.
See what's exposed about you.
30 minutes. One free exposure report. No commitment. We'll show you what we find — and exactly how we'd remove it.