Threat intelligence has a relevance problem. A feed can be perfectly accurate and still be useless, because it tells you about campaigns against other people. The analyst's real work is the translation step: does this affect us, and how urgently?
ThirdWatch, Blackwired's cyber defence platform, is built around eliminating that translation step. Its core claim is the production of Direct Threat Intelligence (DTI): insight and analysis specific to an organisation at global, regional, country and organisational level, rather than a generic picture of the threat landscape.
The distinction sounds like marketing. It is not, and it is worth unpacking what actually has to be true for it to work.
Four layers of baseline
ThirdWatch analyses threats across four layers: the organisation itself, its related domains, its third parties, and the wider illicit ecosystem it is exposed to. The platform's premise is that the adversary's infrastructure frequently hides behind legitimate services — the reason so much hostile activity is invisible to blocklists and reputation scoring. Identifying threats developing behind legitimate infrastructure, and mapping the adversarial networks behind them, is the technical heart of the thing.
Two consequences follow. First, the output is evidence-based rather than reputational: scoring built on observed activity, proximity to your estate, and threat escalation, rather than on how suspicious an indicator looks in aggregate. Second, it produces something a board can read. Rather than a severity-9 alert with no context, you get a net risk score tied to specific, named hostile infrastructure and its relationship to your organisation or your suppliers.
Where it plugs in
The most consequential design decision is delivery. DTI is pushed into the customer's existing security stack through a secure API, in real time. That matters for a practical reason that anyone who has run a security programme will recognise: intelligence that requires an analyst to log into another portal is intelligence that gets checked on Tuesdays.
Pushing it into the stack means the existing tooling — the SIEM, the SOAR playbooks, the vulnerability management workflow — can act on it automatically. It also means no rip and replace, no agents, no sensors, and no architecture change. For most enterprises that is the difference between a capability that gets deployed and one that gets piloted to death.
The part most vendors skip: known vulnerabilities
The Enhanced Attack Surface Management module is, in our view, the most useful component and the least discussed.
Most organisations have two disconnected truths. Truth one: a vulnerability report, listing what is unpatched inside the estate. Truth two: a threat picture, describing what adversaries are actively doing. The gap between them is where remediation prioritisation actually happens, and it is usually bridged by an experienced person's judgement at speed, under pressure, with incomplete information.
ThirdWatch's eASM maps direct external threats to the vulnerabilities the organisation already knows about, in a standardised format. The effect is to collapse the analysis cycle and, more importantly, to kill false positives: a critical CVSS score on a system nobody is targeting is not your most urgent problem, and a moderate score on the exact thing a named actor is currently exploiting probably is.
The question is never “how bad is this vulnerability?”. It is “how bad is this vulnerability, to this adversary, right now?”
Third-party risk, and why DORA changed the conversation
Third Party Risk Intelligence extends the same evidence-based scoring across the supplier network, ranked by operational importance. For financial entities in scope of DORA, and for European operations under NIS2, that is not a nice-to-have. Both regimes place obligations on how you assess, monitor and evidence the resilience of third parties — and a supplier questionnaire completed eighteen months ago is not evidence of anything current.
The uncomfortable finding, in most programmes we look at, is that the weakest link is not the supplier everyone worries about. It is a mid-tier provider with privileged access, poor external hygiene, and no one watching its threat exposure.
How to evaluate a claim like this
If you are assessing any pre-emptive platform, including this one, four questions separate substance from theatre.
- Is the intelligence organisation-specific? Ask to see a sample report for a real entity. If it could have been written for anyone, it was.
- Is it evidence-based or reputational? Ask what the score is computed from, and whether you can see the underlying observations.
- Does it arrive in your tools? API delivery, documented schema, or a portal you will stop logging into.
- Can it map to what you already know is broken? Intelligence that cannot be joined to your vulnerability data leaves the prioritisation problem exactly where it was.
Pre-emptive defence is a crowded label and a thin field. The platforms worth buying are the ones that shorten the distance between an observation outside your perimeter and an action inside your workflow.
Blueridge deploys ThirdWatch across engagements in the GCC. For a technical briefing or a sample DTI report, get in touch.
Written by the Blueridge team. If this is close to a problem you are working on, we are happy to talk it through.
Start a conversation