Why Your CTI Team Doesn’t Have a HUMINT Specialist And Why That’s a Problem Most cyber threat intelligence teams from small corporate security groups to large, government-affiliated units have never had a dedicated HUMINT specialist. That’s not a ho...

Deception Has an Expiration Date. Here's How to Measure It. Why "false completion paths" for AI-driven attackers stop working — and how to know exactly when yours will. There's a moment every defensive deception eventually reaches: the trap that u...

Ask most security teams what “threat hunting” means and you’ll get an answer built entirely out of technical nouns: indicators, signatures, telemetry, alerts. Ask them how a threat actor decides who to trust, and the room usually goes quiet. That ga...

The Invisible Layer: What Threat Hunting Looks Like From the Inside TLP:CLEAR — public distribution There’s a moment every SOC analyst knows well. An alert fires. The queue lights up. Someone pulls the indicator, traces it to a signature, writes it...

Both sides of the cybercrime fight are now burning enormous compute for marginal gains. Here’s what that actually means. For almost twenty years, operational security on the dark web was a human craft. Burner accounts, PGP keys rotated on a schedule,...

Part VII of the Synthetic HUMINT sHUMINT methodology series. Since Part III, I’ve referred to a coming horizon the point where AI systems stop borrowing tradecraft from historical attacks and start generating their own. I said that shift would eventu...

Part V showed that AI-driven attacks still carry human residue stylometric, chronometric, lexicographic because for now, most of this tradecraft is executed by a human-machine hybrid, not a fully independent system. This part addresses the obvious ne...

Parts I through IV established the architecture of sHUMINT: behavioral profiling, probing, consistency testing, and attribution. Each pillar operates on the assumption that an AI-driven attack carries structural seams technical, logical, and motivati...

Part I introduced the four pillars of Synthetic HUMINT: behavioral profiling, probing, consistency testing, and attribution. Part II built the baseline the stable habits that make up a model's behavioral signature. Part III showed what happens when y...

Consistency Testing: Why Contradiction Reveals More Than Agreement Part III of the Synthetic HUMINT sHUMINT methodology series. Part I introduced the four pillars behavioral profiling, probing, consistency testing, and attribution. Part II went deep ...

Profiling the Machine: Why Synthetic HUMINT Is About to Matter More Than You Think For most of my career, HUMINT tradecraft has meant one thing: understanding people. Reading behavior, spotting inconsistency, testing reliability, building a profile o...

You Are Already In It: How Cognitive Warfare Reaches Ordinary People And Where the Dark Web Quietly Feeds It Part three of the Cognitive Warfare series. Part one mapped the convergence of influence operations and the underground economy. Part two for...

The Soft Target: Why Eastern Europe Is the Testing Ground for the Next Wave of Cognitive Warfare Part two of the Cognitive Warfare series. Part one, "The Same War, A Faster Engine," argued that influence operations and the dark web underground have m...

The Same War, A Faster Engine: Cognitive Warfare’s Marriage to the Dark Web Underground It took me a few months to write the articles in Cognitive Warfare articles , The most important link, the one with dark web services and threat actors from tor/...

What I’m seeing right now on the dark web tells me the next major attack wave is not a question of if. It is a question of how ready you are when it arrives. I monitor dark web/underground ecosystems for a living. I have been doing it for nearly two...

By Adrian Alexandru — Lead Analyst, Aether Intel aether-intel.com I have spent nearly two decades monitoring dark web ecosystems not through dashboards, not through vendor feeds, not through scraped data. Through direct, sustained presence inside un...

What nearly two decades of observing dark web ecosystems taught me about how influence operations really work. It often starts much deeper in underground communities most people never see. A lot of people across Eastern Europe have quietly decided...

While Europe Regulates, the Dark Web groups Are Already Recruiting the Next Generation of AI Weapons Specialists The sovereign AI race is not a competition Europe can prepare for. It is a competition Europe is already inside. I have spent nearly tw...

The Disinformation Supply Chain: How Coordinated Influence Campaigns Are Built Before They Go Viral Article from Digital HUMINT Series, For better understanding read the full report Right now, somewhere on X/forum people are fighting about a post ...

Inside the document that decides what millions of people will believe before anyone hits "publish." HUMINT — Behavior Analysis Series · Based on GREY NEXUS report GN-064, "Narrative Architects" By the time a piece of disinformation reaches your fee...