Insights on Adversarial Infrastructure Risk
Pre-attack intelligence, autonomous defense, and real-world outcomes.
Featured & Latest Insights
A failed delivery, a waiting client, and a fix that took thirty minutes instead of half a day, because the AI already knew our system. How we built a skill wiki that every AI we use reads from, and how you could start one on Monday.
On 29 October, Binance was breached: its own signing infrastructure paid roughly $6.3 billion to an attacker. Its first explanation was a compromised DevOps engineer's laptop. A laptop is a how. It is not a who, and it is not a when. Something has to be built to compromise a laptop, and it gets built in public, before the night it is used.
Washington and the labs banned frontier AI from China, Russia and Iran. Anonymous web shops sell it there anyway, in yuan, roubles and rials, at up to 70% off, no questions asked. VisionHeight found the shops, the stolen keys and resold subscriptions that stock them, and the buyers the labs never see.
A network of 37 anonymous “local news” sites, set up in a single evening, is feeding ready-made midterm answers to the AI chatbots voters increasingly consult.
See how Elliot enriches CrowdStrike Falcon identity, firewall, and perimeter detections with VisionHeight’s own internet observation data and evidence-backed agentic triage.
A Splunk enrichment app delivering preemptive adversary infrastructure intelligence: Pulse Signal verdicts on any IP or domain, without leaving your investigation.
VisionHeight Managed Rules bring proactive threat intelligence to AWS Network Firewall, blocking malicious infrastructure early and reducing mass-scanning and Tor noise.
VisionHeight's Pulse Telemetry captured telecom-targeting reconnaissance, uncovered undisclosed infrastructure, and flagged attacker IPs months before Google's public disclosure of UNC2814.
VisionHeight's proprietary Pulse Telemetry expanded 9 published IOCs from a destructive attack on Polish energy infrastructure to 38 infrastructure nodes — 24 of which remain operational today.
In our first post, we made the case that agentic SOC platforms are missing the intelligence foundation they need. This post introduces what we've been building to solve it.
Everyone is building SOC AI agents. Almost nobody is asking what those agents actually know about the external threats they're supposed to find. We built the intelligence layer to fix that.
The problem every security team knows too well: You start with one suspicious IP. Hours later, you're still pivoting across five tools, reconstructing what turns out to be a coordinated campaign. By the time you connect the dots, the adversary has rotated to fresh infrastructure.
