Lesson #4: Tools don't catch insider threats. Analysts do.
Insider activity is subtle — individual data points look benign. Detection comes down to context and human judgment.
Synapse helps analysts connect the dots. But the insight? That's irreplaceable.
vertex.link/blogs/inside...
Indicator-driven defenses tell you what was bad yesterday. Proactive pattern recognition helps you anticipate what's bad tomorrow.
Our webinar walks through using the @censys.bsky.social-Synapse Power-Up to level up threat hunting
www.youtube.com/watch?v=raKQ...
Here’s what that looks like in practice 👇
Using colorize, analysts can instantly distinguish cold vs. warm infrastructure clusters based on created timestamps—making patterns easier to spot and pivots faster to execute.
A few weeks ago we dropped the colorize Storm command—bringing run-time colors to tables, maps, and force graphs.
In our Slack, Golo Mühr’s IBM X-Force team used it to instantly surface cold vs. warm infra clusters by their created timestamps.
How are you using colorize?
For reference, here is Golo's force graph visualization:
Missed the webinar with @censys.bsky.social?
Our follow-up blog shows how analysts can pivot from indicators to infrastructure patterns using the Synapse-Censys Power-Up — and turn findings into lasting intelligence.
Find it here: vertex.link/blogs/censys...
🎉A brand new Synapse Power-Up is here!
The new @DoppelHQ Synapse Power-Up brings Doppel alerts into the workflow, helping teams spot typosquatting, correlate activity, and take faster action.
A new step forward for brand protection inside Synapse: synapse.docs.vertex.link/projects/rap...
Staying ahead of the constant flow of intelligence data isn’t about collecting more, it’s about connecting the right signals faster.
Ryann Hallback (reign) shows how analysts cut through noise, link critical data, and move investigations forward with confidence. www.youtube.com/watch?v=84oG...
No analyst gets perfect information.
The best ones find a path forward regardless.
Lesson #3 from Operation Deepfake explores how real investigations require decisions under uncertainty and the discipline to revise them when new evidence appears.
Dive in: vertex.link/blogs/inside...
The team is together in Curaçao this week for some face time, planning, and collaboration 🌴
As a remote-first company, time onsite at The Vertex Project is a rare chance to align on what’s next — with good ideas, great conversations, and a little sunshine to help.
A login time
A download
A meeting invite
Harmless alone. Suspicious together.
Nothing stands out until you connect the dots — then the real story appears.
See all the lessons learned from Operation Deepfake here: vertex.link/blogs/inside...
Missed our webinar on tracking DDoSia’s rapidly changing infrastructure?
We covered how analysts use the Synapse–Censys Power-Up to enrich infrastructure, query host data, and spot fast-moving DDoS campaigns tied to hacktivist activity.
Watch on demand: www.youtube.com/watch?v=raKQ...
Oops! If you attempted our CYBERWARCON Challenge - Operation Deepfake - you likely received an error - our apologies! We “fixed the glitch” ;)
Try it here: vertex.link/blogs/inside...
TOMORROW we’ll host our webinar with Censys! Attackers can rotate infrastructure faster than threat hunters can keep up. Learn how defenders can pivot from indicators to infrastructure-centric intelligence. @vtx-savage.bsky.social + @silascutler.bsky.social
Register: vertex.link/events/censy...
Sharing is caring (and not just because it rhymes).
Insider incidents don’t sit neatly in one department—collaboration across teams is what speeds investigations.
A key lesson from Operation Deepfake on VISI.
Read more: vertex.link/blogs/inside...
In our latest video, Ryann Hallback (reign) shows how the Vertex-Triage Power-Up helps CTI teams prioritize and streamline OSINT triage using Synapse.
🎥Watch here: www.youtube.com/watch?v=84oG...
After a long day of cactus-conning, join our happy hour on Friday in the Main Hall from 3-6PM, sponsored by Vertex.
Or afterwards at the afterparty at Level One from 6-7:30PM, sponsored by Arctic Wolf.
For CISO badge folks, on Saturday in the Delta happy hour is from 5-7:30PM.
See you TOMORROW!
Headed to @cactuscon.com tomorrow? Drinks are on us 🌵🍹
The Vertex Project is sponsoring Happy Hour (3–6 PM). Find Dylan Hennessy for drink tickets and come chat Vertex, Synapse, and investigations.
See you there.
Next week we’ll host our webinar with @censys.bsky.social! Attackers can rotate infrastructure faster than threat hunters can keep up. Learn how defenders can pivot from indicators to infrastructure-centric intelligence. @vtx-savage.bsky.social+@silascutler.bsky.social
vertex.link/events/censy...
Thank you @vertexproject.bsky.social for being #PIVOTcon26 Platinum Sponsor 🎉
Read more about them at vertex.link
They deliver #Synapse, advanced intelligence and analysis technology that transforms complex data into actionable insight.
Check our sponsors at pivotcon.org/sponsors
Our latest blog post highlights core insider threat lessons around collaboration, context, and analyst decision-making when clear red flags are absent. Find it here: vertex.link/blogs/inside...
2 weeks til our webinar with @censys.bsky.social! Attackers can rotate infrastructure faster than threat hunters can keep up. Learn how defenders can pivot from indicators to infrastructure-centric intelligence.
@vtx-savage.bsky.social + @silascutler.bsky.social
vertex.link/events/censy...
Insider threats won’t look like the stereotypical "hacker in a hoodie."
Operation Deepfake will challenge you to investigate an insider threat scenario using shared intel - not just indicators. Try it here: vertex.link/blogs/inside...
A bit of light-hearted fun from the latest Synapse + Optic release. The "colorize" command lets you specify runtime colors for nodes which take precedence over Workspace color configs. This hilarious example uses part of the node hash as a random color value 😂🤩🌈
How do you track DDoS infrastructure when C2 servers rarely last a day?
@vtx-savage.bsky.social and @silascutler.bsky.social are breaking down real-world DDoSia hunting using the Synapse-Censys Power-Up in our next webinar.
vertex.link/events/censy...
For those interested in participating, you can learn more about the challenge and how to access it here:https://vertex.link/blogs/insider-threat-challenge/
Our Insider Threat Challenge was featured in an @ooda original, highlighting how hands-on scenarios like Operation Deepfake help analysts practice real-world investigations.
🔒 Subscriber article: oodaloop.com/analysis/ood...
Join our webinar with @censys.bsky.social to learn how infrastructure-centric intel lets you pivot across ASNs, provider tiers, & rapidly changing adversary assets
Presented by @vtx-savage.bsky.social & @silascutler.bsky.social
vertex.link/events/censy...
Why do Views and Layers matter for security teams?
Because not all collaboration should be fully visible.
They let teams:
🔹Work in parallel
🔹Restrict access to sensitive data
🔹Collaborate securely
Learn more here: vertex.link/blogs/views-...
#CTI #Synapse
Can you catch an insider threat before it’s too late? Operation Deepfake - a hands-on insider threat challenge built in Vertex Synapse - is live.
Try it here: vertex.link/blogs/inside...
