Read as
Last updated: April 29, 2026
“Who did this?” is often the wrong question. Attribution is hard, slow, and often inconclusive. Defenders mostly need TTP-level intel, not actor identity.
“Who did this?” is often the wrong question. Attribution is hard, slow, and often inconclusive. Defenders mostly need TTP-level intel, not actor identity.
The Diamond Model
Four vertices of an intrusion analysis:
- Adversary — who
- Capability — what tools, what TTPs
- Infrastructure — what domains, IPs, code-signing certs
- Victim — who/what was targeted
Pivot between vertices: from victim → infrastructure → other victims (= campaign scope).
Want this for your team?
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.
Book team training call
Replies in 4 working hrs · India-only · Senior consultants