Dracosec Research Limited Logo

Managed Threat Intelligence Service

Cyber Threat Intelligence

A curated, Hong Kong-aware threat intelligence service. Critical alerts and structured digests land in your inbox; full context, enrichment, and history live on the Security Assurance Portal β€” so your team is informed without drowning in noise.

<15 min
Critical alert delivery
HK
Relevance filtering
24/7
Continuous collection
Threat Intelligence dashboard β€” HK-relevant alert with full enrichment

Signal, not noise

Most threat feeds drown defenders in CVEs that will never matter to them. Ours aggregates from the same sources β€” then filters and ranks against the things that actually do: your tech stack, your sector, and the threat landscape facing Hong Kong.

Local context, global coverage

Multi-source pipeline, aggregating regional CERT advisories, vendor disclosures, ransomware leak-site listings, and underground chatter β€” then filtered for Hong Kong relevance and your operational footprint.

Deliver directly to your inbox

Critical alerts arrive in less than 15 minutes. Structured daily or weekly digests separate global threats from HK-relevant signals β€” readable on a phone, archivable in your team's mailbox.

Drill into the detail

Every email links back to the full record on the SA Portal β€” enrichment, IOCs, affected products, related campaigns, and historical context for the threat actor involved.

Service Capabilities

What's inside

From inbox to investigation β€” the capabilities that make this a working intelligence service rather than another feed to triage.

Critical alert email β€” Hong Kong market threat with reporting flag

Real-time Critical Alerts

Minutes from disclosure to your inbox

Known-exploited CVEs against your tech stack, ransomware leak-site listings naming HK victims, and confirmed local incidents trigger immediate notification β€” not buried in a daily summary, not waiting for a weekly review cycle.

  • <15 min target SLA β€” from source publication to inbox for tier-one alerts
  • KEV catalog integration β€” known-exploited vulnerabilities flagged on sight
  • Inline rationale β€” each alert explains why it surfaced and why it matters to your environment
  • Cap. 653 reporting flag β€” events with statutory notification implications are clearly marked for CI operators
Threat Intelligence portal β€” full enrichment view with HK relevance scoring

Daily & Weekly Digests

Structured intelligence on a cadence you choose

Pick the rhythm that fits your team β€” daily for active security operations, weekly for leadership briefings. Every digest is structured, dated, and archivable β€” useful as both situational awareness and an evidence trail.

  • Hong Kong relevance filter β€” explicit HK signals plus AI-inferred local impact
  • Tech-stack alignment β€” items ranked by what's deployed in your environment
  • Sectioned layout β€” HK-relevant signals separated from global threats so each audience scans the part they care about
  • Per-recipient cadence β€” different stakeholders can receive daily or weekly streams independently
APT Activity Heatmap β€” 30-day threat actor activity grid

APT Activity Heatmap

See which threat actors are active right now

A 30-day activity grid for tracked APT groups β€” Akira, UNC clusters, Storm-0961, BlueNoroff, and the rest of the threat-actor catalogue you actually need to follow. Spot trending campaigns at a glance, drill into any group to see the specific threats it has been linked to.

  • 30-day rolling window β€” heat-coded cells highlight when each actor was last seen and how often
  • Click-to-drill β€” tap any APT group to surface the specific campaigns and threat reports linked to it
  • Pattern recognition β€” see which actors are accelerating, going dormant, or freshly emerging
  • Strategic context β€” connect campaign-level patterns to the individual alerts you receive

Sources

Where the signal comes from

A multi-layered collection pipeline β€” public, vendor, and underground sources, normalised into a single relevance-scored stream.

CERT & government advisories

HKCERT, GovCERT.HK, CISA, NCSC, and regional CERTs β€” official disclosures and confirmed local incidents.

Vendor disclosures

Microsoft, Cisco, Fortinet, Palo Alto, and the rest of the vendors you actually run in production.

Ransomware leak sites

Continuous monitoring of leak-site listings β€” early warning when HK organisations are named.

Underground & OSINT chatter

Forum, paste-site, and dark-web monitoring for credential leaks and emerging campaigns.

Delivered Through

Email first. Portal for depth

Threat Intelligence is delivered primarily by email β€” because that's where your team already works. When an alert needs investigation, every message links into the SA Portal, where you'll find the full record: enrichment, IOCs, affected products, linked campaigns, and historical context for the threat actor involved.

  • No new tool to learn β€” alerts and digests arrive in the inbox you already monitor
  • Portal access included β€” every TI subscriber gets a SA Portal workspace with full intelligence history
  • Searchable archive β€” query past alerts, filter by actor, CVE, or sector
  • Multi-tenant isolation β€” your tech-stack profile and watchlists are never shared across clients
Explore the SA Portal
Security Assurance Portal β€” Threat Intelligence section with full enrichment

Getting started

A short onboarding designed to have your first relevance-tuned digest in your inbox within the first week.

1

Scoping call

A short session to understand your tech stack, sector, and the threat profile you care about most.

2

Profile build

We configure your relevance filters, watchlists, and recipient distribution rules.

3

Portal provisioning

Your SAP workspace is provisioned with role-based access for analysts and leadership.

4

Live delivery

Real-time alerts and your first scheduled digest arrive, refined as your team's feedback comes in.

Ready to cut through the noise?

Talk to us about your environment and the threats you actually need to track. We'll put together a sample digest tuned to your stack so you can see the signal-to-noise difference before you commit.