Intel 471 Knows What Cybercriminals Are Shopping For

The cybercrime business has a procurement department. Somebody needs stolen passwords. Somebody else has access to a company network to sell. Malware developers supply tools; brokers supply introductions. By the time a defender sees the resulting attack, several commercial transactions may already have taken place. Intel 471 has built a company around watching that earlier part of the story.

Its customers buy a view into the criminal underground: the people, infrastructure, markets and conversations that can help explain what a threat actually means. An exposed server is one problem. Evidence that criminals are interested in exploiting it makes the problem more urgent. A leaked account becomes more useful intelligence when an analyst can establish whose account it is, where it appeared and how it might be abused.

That distinction explains Intel 471’s evolution. The company began with adversary intelligence. It now also sells tools for finding exposures and hunting suspicious behavior. The commercial proposition is becoming easier to state: learn something about the attacker, then give the defender a practical next step.

A business built around people who sell trouble

Mark Arena and Jason Passwaters founded Intel 471 in 2014. Arena’s background included the Australian Federal Police; Passwaters brought military counterintelligence and human intelligence experience. Both had worked at iSIGHT Partners. Those careers help explain a company that treats language, relationships and local knowledge as part of its technical equipment.

Intel 471 describes a team of intelligence operators and native speakers located near the communities they study. Its stated culture emphasizes humility and quiet professionalism. The fit is understandable: in this line of work, understanding a conversation can be more valuable than making a conspicuous entrance. The company’s mission centers on protecting customers’ organizations, assets, products and people.

Human collection runs alongside automation. The software can gather and organize activity at scale; analysts interpret relationships and relevance. The company also uses its Malware Emulation and Tracking System, or METS, to observe malware infrastructure. That gives its researchers another line of evidence beyond what a seller claims in a forum. Criminals have sales pitches, too.

The expensive part of staying independent

The company was bootstrapped before Thoma Bravo’s 2021 investment. In a February 2026 investor podcast, Passwaters recalled long procurement cycles that sometimes left the founders unpaid. The early pressure point was cash timing, even in a business he described as profitable.

What changed their minds about outside ownership was the need for operating help. Passwaters said they chose Thoma Bravo’s more involved approach over a slightly larger offer. Budgeting, forecasting and sales management became part of the work of building a bigger company. The lesson is specific: expertise that wins customers does not automatically supply the systems needed to serve more of them.

The investment’s financial terms were undisclosed. Customers encounter a subscription business, with platform access, intelligence and integration capabilities sold through a commercial relationship. The purchase also asks something of the buyer: time to define requirements and turn findings into decisions.

First a SpiderFoot. Then a Cyborg.

Intel 471’s acquisitions are a useful guide to its ambitions. In November 2022 it bought SpiderFoot, an open-source intelligence automation and digital-investigation business. SpiderFoot could start with a small piece of information and connect it to a wider set of exposed assets and related data. Founder Steve Micallef joined Intel 471 as vice president of attack surface technology.

The deal extended the view toward the customer. Intelligence about an attacker becomes more useful when a defender can see where that attacker’s interests intersect with the organization’s exposed systems. SpiderFoot supplied technology for exploring that external footprint. Its open-source roots also give technically inclined readers something tangible to examine.

In May 2024, Intel 471 acquired Cyborg Security, founded in 2019. That purchase brought the HUNTER platform and behavioral threat hunting expertise. Now the sequence could run from an adversary’s activity, through an exposed asset, into a search for related behavior inside the customer’s environment. The two purchases addressed different parts of the same operational problem.

TITAN’s next act puts the work in one place

In July 2025, Intel 471 introduced Verity471 as the evolution of TITAN, its established intelligence platform. The new arrangement brought three portfolios together: Exposure, Intelligence and Hunt. A mode switcher lets users move between them without repeatedly signing in. It sounds like a small interface decision, but security work routinely crosses those boundaries.

Consider the questions a team needs to answer. Intelligence asks who is active and what they are doing. Exposure asks which assets or relationships could be affected. Hunt asks whether relevant behavior can be found internally. Keeping those questions close together gives a report a better chance of becoming an investigation.

The platform’s intelligence spans adversaries, malware, compromised credentials and vulnerabilities, among other domains. Its marketplace views organize underground listings, vendors and products. Its vulnerability intelligence considers the progression toward exploitation, adding context that a severity score alone cannot supply. The interface is full of the unglamorous objects security teams actually work with: lists, filters, alerts and evidence.

The access broker meets the patch queue

A concrete example appears in Intel 471’s July 2025 account of its exposure products. Its researchers reported unauthorized access offers affecting 345 unique organizations in the second quarter of that year. Corporate remote access portals, remote desktop services and enterprise VPNs featured among the technology categories being offered in underground markets.

That is a count of organizations in observed offers, not a count of Intel 471 customers or attacks it prevented. The distinction matters. The product’s useful job is to connect such external intelligence with an organization’s exposure findings. A domain mentioned in an access offer can become a prompt for investigation instead of another item in a general threat digest.

Credential intelligence addresses another practical question: has an employee, customer or supplier account appeared in compromised material? Intel 471 describes monitoring and alerting with context about the affected party. For a security team, the next decision depends on that context. A current employee account and an old, unrelated record should not receive identical treatment.

A hunt should start beyond a blank query box

The hunting business addresses a different bottleneck. Knowing an adversary’s techniques does not mean a team has the time or experience to write, test and manage a useful hunt. Intel 471 packages research, hypotheses, queries and testing into content for major security monitoring and endpoint platforms. Its website advertises more than 700 ready-built hunt packages.

Hunt management features track findings and assignments across incident response, security operations and intelligence teams. Guided queries help an investigator decide where to look next. This is the difference between receiving a clue and receiving a structured way to examine it. It still requires someone to assess what the investigation reveals.

Distribution matters here. In May 2025, Intel 471 announced HUNTER content for Google Security Operations. The integration lets customers apply behavioral hunt material in an environment they already use. Its official Python SDK offers another route into the intelligence, including query validation and STIX mapping, a format used to exchange structured threat information.

AI gets a seat beside the analyst

On July 28, 2026, Intel 471 announced Agent471 and MCP471. Agent471 is designed to synthesize intelligence and return answers with citations. MCP471 connects that intelligence to compatible AI tools and agent workflows. Both tackle the distance between information stored in a specialist platform and the place an analyst is trying to get work done.

The idea is practical: ask a question, retrieve relevant intelligence and use it in an investigation or briefing. Intel 471’s pitch keeps human collection and analysis at the center while using AI to speed access and synthesis. The company’s product identity still rests heavily on the information feeding the system.

Research continues alongside the platform releases. In September 2026, the company published work on AppPanda, a phishing operation targeting Spanish-speaking Android users in Mexico. That kind of geographically specific investigation illustrates why a broad label such as “dark web monitoring” tells a buyer relatively little about a provider’s actual coverage.

Buy a better decision

Intel 471 serves enterprise and government intelligence, security, fraud and risk teams. It competes for attention and budgets with providers including Recorded Future, Flashpoint, Google Threat Intelligence, CrowdStrike and Group-IB. These businesses have overlapping capabilities. The meaningful comparison is what each can observe, how it supports a finding and how well that finding fits the customer’s work.

“Not every organization is ready for full-on adversary intelligence.”Jason Passwaters / CEO and co-founder

A team needs a way to consume the information. Exposure monitoring and prepared hunts lower the effort, but they do not create internal telemetry, assign an absent owner or make a remediation decision happen. Without those ingredients, another intelligence subscription can become another unread queue.

Readers can copy a piece of Intel 471’s method without copying its collection network. The company publishes an intelligence-requirements framework, CU-GIR, that connects collection to organizational priorities. Start with a question that could change a decision. Identify who needs the answer. Decide what evidence would justify action and where that action belongs.

Applied to a patch queue, that means asking which exposed systems intersect with active adversary interest. Applied to an investigation, it means deciding which behavior to search for and what data is needed to find it. The discipline is modest, repeatable and demanding: every interesting discovery should have somewhere useful to go.