Know before the attack happens.

Most CTI vendors resell feeds aggregated from third parties (VirusTotal, Mandiant, Recorded Future). Fortgale generates original intelligence from three primary sources: incidents handled by the SOC daily, independent threat actor research, continuous deep & dark web monitoring. Contextual, current, applicable intelligence.

Indicators of Compromise (IPs, domains, hashes, URLs, YARA rules) are produced from real incidents and research on offensive infrastructure. They are distributed automatically to customer SIEM/EDR/firewalls via STIX/TAXII and applied as Custom Threat Intelligence on MDR platforms, blocking known threats before impact.

Search for compromised corporate credentials in criminal marketplaces, monitoring of forums where actors plan attacks, detection of exfiltrated data on ransomware leak sites, tracking of Telegram channels and anonymised networks, real-time alerts when the customer name appears.

Two formats: technical reports for security teams (SOC analysts, threat hunters, technical CISOs) with IOCs, MITRE-mapped TTPs and operational guidance; executive reports for management with risk language, business impact, and prioritised actions. Published in English and Italian.

Yes. The CTI service is available both as an integrated component of SOC/MDR (intelligence applied automatically to detection rules) and as a standalone service for companies with internal security teams who want to enrich it with proprietary IOC feeds, vertical advisories, and threat actor reports.

Fortgale ASM performs continuous discovery and monitoring of the customer's external attack surface: internet-facing assets, exploitable vulnerabilities, shadow IT, expired certificates, leaked credentials, cloud misconfigurations (S3, Azure Blob, GCP). Everything is correlated with internal threat intelligence to prioritise what is actually exploitable by actors active against the customer's sector, not a list of theoretical vulnerabilities, but a list of concrete risks.

Monitoring of the non-IT attack surface: look-alike domains, fake LinkedIn/Telegram profiles impersonating executives, phishing kits using the customer's logo, executive impersonation, deepfakes, reputational mentions in criminal channels. Coordinated take-down with providers (registrars, social platforms, hosters) where feasible.

Yes. The Executive Briefing & Board Reporting service produces dedicated reports for the board and risk committees in business-risk language: exposure status, actors active against the organisation, NIS2 and DORA compliance, required decisions, potential economic impact. An operational tool for cyber governance at board level.

Technical attribution is part of Threat Actor Profiling. When the CTI team detects an incident, observed TTPs (MITRE ATT&CK-mapped), C2 infrastructure, tooling, malware code, and victimology are correlated with profiles of already-tracked actors. When evidence is sufficient, a documented attribution is formulated. When it is not, the most likely hypotheses are indicated without overreach, rushed attribution is one of the most common bad practices in commercial CTI.

A CTI platform is the environment where threat intelligence is consulted and applied to the organisation's context. Fortgale's is the Fortgale Defence Platform: it offers Contextual Intelligence and Advanced Intelligence, the profiles of the 287 tracked actors and tools, and the AI Assistant, with analysts from the Milan SOC working on the same data as the customer.

CTI is intelligence on adversaries: who attacks, with which tools and infrastructure. AI Security protects the artificial intelligence systems the organisation uses. They are two distinct services: CTI informs the defence, AI Security extends its perimeter to AI systems.