Treadstone 71 / Founder's briefs
What is cyber counterintelligence?
Cyber counterintelligence is the practice of detecting and defeating an adversary's intelligence effort against your organization online: the reconnaissance, the false personas, the recruited insider, and the deception fed to your analysts. Treadstone 71 LLC certifies cyber counterintelligence analysts and runs OPSEC assessments, insider threat maturity reviews, and elicitation defense for government and corporate teams.
Security teams defend networks. Somebody has to defend the analysts.
Every serious adversary runs collection against the people hunting him. He reads your job postings to learn your tools, and he approaches your engineers on LinkedIn behind a recruiter's face. A forum gets seeded with a leak built for your team to find and believe.
None of that trips a firewall rule.
The other side has an intelligence service too
For two years I lived online as a spokesman for the Taliban. Work like that teaches one rule fast: the other side vets you as hard as you vet them. Corporate teams forget the rule. Threat researchers publish under real names, post conference badges, and list every tool on a public profile. Mapping the whole team takes an Iranian or Russian service one afternoon. One. After that comes the analyst with the mortgage problem, and a friendly first message.
Counterintelligence begins with admitting you are a target.
What the discipline covers
- OPSEC for the intelligence team: Research infrastructure, attribution hygiene, and what your own staff leak in public. See the online OPSEC assessment.
- Persona and elicitation defense: Spotting the hostile contact, and training staff to recognize a conversation steered toward restricted ground. The Elicitation Protocol covers the mechanics.
- Insider threat: A maturity model for the program, built on behavior and access rather than keyword alerts. See the Insider Threat CMM.
- Deception detection: Asking of every item: who wanted us to find that? The ASA Evidence Standard scores the answer as a D-Score, the odds that hostile hands touched the item. Floor of 25, because no item is ever presumed clean.
Offense teaches defense
An analyst who has built and run a lawful research persona spots a hostile one faster. She knows how long a legend takes to age, and which details a rushed operator skips: the empty years in a work history, the profile photo that reverse-searches to a stock library, the friend list made in one week.
Our Cyber Counterintelligence Tradecraft Certification teaches the offensive craft under written rules of engagement so students learn to see the same craft pointed at them. The on-demand version is the Certified Cyber Counterintelligence Analyst program.
Where to start
Start with your own exposure.
Pull what an outsider finds on your intelligence staff in one working day. Names, home towns, certifications, the tools on every resume, the conference talks with slide decks still posted. Most teams stop the exercise by lunch, because the file is already thick enough to run an approach against any one of them.
Treadstone 71 has taught cyber counterintelligence since 2002. I built the academic version at Utica College between 2009 and 2014, alongside programs in cyber intelligence and cybercrime.
Questions buyers ask
How does cyber counterintelligence differ from cyber threat intelligence?
Threat intelligence studies the adversary's operations. Cyber counterintelligence studies and defeats the adversary's intelligence collection against you, including reconnaissance of your staff, hostile personas, insider recruitment, and planted evidence.
What is the D-Score?
One of three scores in the ASA Evidence Standard, Public Edition 1.0. The number expresses how probable hostile shaping of an item is. A floor of 25 applies, and a climbing score holds the decision.
Who needs cyber counterintelligence training?
Intelligence and threat research teams, insider threat programs, executive protection staff, and any organization whose analysts research hostile state or criminal actors.
