Digital intelligence glossary.

Collection and analysis of open or lawfully accessible information to answer a defined question.

Caution: Technical accessibility alone does not make every collection lawful or proportionate.

Preserve evidence →

The people, entities, periods, countries, sources and questions covered by research.

Caution: Overly broad scope increases noise, unnecessary data and error risk.

Preserve evidence →

An identifier used to move from a verified item to another source, such as a domain, alias or official number.

Caution: A shared pivot does not prove that two items belong to the same person.

Preserve evidence →

Confirmation of a fact through genuinely independent, dated evidence suited to the question.

Caution: Multiple repetitions of one claim still represent one original source.

Preserve evidence →

Material produced directly by the actor, system or institution connected with the fact under review.

Caution: It strongly establishes the statement or record, not necessarily its complete truth.

Preserve evidence →

Analysis, synthesis or reporting based on primary sources or other publications.

Caution: Return to cited references before relying on a material claim.

Preserve evidence →

The degree to which an item relies on collection, testimony or method separate from other sources.

Caution: Different publishers may depend on the same wire report or press release.

Preserve evidence →

Documented origin of an item and the chain showing how it was obtained or transformed.

Caution: Incomplete provenance limits claims that can be made about authenticity.

Preserve evidence →

Reasoned connection between an action, content or asset and a person, entity or group.

Caution: A technical or stylistic coincidence is generally insufficient.

Check an entity →

A person or entity sharing an identical or similar name with the subject under review.

Caution: Always confirm several identifiers before attributing information.

Check an entity →

A trading name, pseudonym or alternative identifier associated with a person or entity.

Caution: The same alias is often used by more than one person.

Check an entity →

Deceptive use of another party’s identity, image or distinctive signs on a digital service.

Caution: Separate public copying, a fake profile and compromise of the legitimate account.

Check an entity →

Human-readable identifier associated with internet services and organised into dot-separated labels.

Caution: In a URL, identify the registered domain before interpreting subdomains.

Audit exposure →

A label before the registered domain, used to organise services or create a misleading appearance.

Caution: A brand name in a subdomain does not mean that brand controls the site.

Audit exposure →

Registration of a domain resembling a known name through a typo, addition or character substitution.

Caution: Similarity is a signal requiring context, not automatic proof of fraud.

Audit exposure →

A certificate used to establish an encrypted connection and identify the covered domain.

Caution: It guarantees neither site honesty nor the claimed business identity.

Audit exposure →

A file, message, log, page or trace capable of supporting a fact when preserved with context.

Caution: Its value depends on origin, integrity and the question being asked.

Preserve evidence →

A value calculated from a file to detect later changes to its content.

Caution: A hash proves neither author, original date nor truth of the file.

Preserve evidence →

Information describing a file or content, such as format, dates, device, declared author or processing.

Caution: Metadata can be absent, altered, removed or created by software.

Preserve evidence →

Record of people, copies, transfers and transformations applied to a preserved item.

Caution: Legal requirements vary; obtain suitable advice where proceedings are contemplated.

Preserve evidence →

Observable assets, information and people that may be used to understand or target an organisation.

Caution: Visible information is not automatically an exploitable vulnerability.

Frame a decision →

An incomplete or isolated item that warrants checking but does not yet support a conclusion.

Caution: Accumulating dependent signals does not replace independent confirmation.

Frame a decision →

Reasoned assessment of how strongly a conclusion is supported given sources and unknowns.

Caution: It is not a universal percentage of truth.

Frame a decision →

A plausible chain connecting a signal, adverse action, affected asset and consequence.

Caution: A scenario supports prioritisation but does not automatically predict an event.

Frame a decision →

An interpretive frame connecting facts, symbols and claims into a coherent reading of a situation.

Caution: Repetition of a narrative proves neither coordination nor truth.

Assess a claim →

Increased content visibility through reposting, recommendation, advertising or coordinated or spontaneous activity.

Caution: High visibility does not necessarily mean broad agreement.

Assess a claim →

Common organisation of actions, messages or timing among several actors or accounts.

Caution: Timing and similarity alone may have other explanations.

Assess a claim →

Movement of a claim through several relays until its weak or interested origin becomes obscured.

Caution: Return to the earliest observable version and identify dependencies.

Assess a claim →

Immediate measures limiting access, spread or impact before complete remediation.

Caution: Preserve useful evidence before irreversible deletion where appropriate.

Audit exposure →

Correction of the cause and conditions that enabled an incident or exposure.

Caution: Visible removal does not prove the cause, copies or access have disappeared.

Audit exposure →

Structured transfer of a case to the level, team or authority able to act.

Caution: State facts, urgency, impact, completed actions and required decision.

Audit exposure →

Post-action review that preserves learning, improves controls and clarifies responsibilities.

Caution: Assess the process without turning the exercise into individual blame.

Audit exposure →

Comparison of an explanation against expected facts and competing explanations.

Caution: A plausible hypothesis is not a confirmed conclusion.

Preserve evidence →

The population, period, method and limits actually covered by a publication or dataset.

Caution: A reliable source may be unsuitable for a question outside its scope.

Preserve evidence →

Careful matching of names, identifiers and attributes to determine whether they refer to the same person or organisation.

Caution: A common name or shared address is insufficient for identity attribution.

Check an entity →

Observed history of relationships between domain names and DNS responses without actively probing target systems.

Caution: An old resolution or shared address does not prove current ownership.

Audit exposure →

Information accompanying a copy: full URL, date, time zone, apparent author and observation method.

Caution: A capture alone proves neither authenticity nor origin.

Preserve evidence →

Period during which an asset or information may have been accessible under stated conditions.

Caution: Discovery time does not necessarily establish when exposure began.

Frame a decision →

Account, outlet or channel that carries a narrative to a new audience.

Caution: Repetition proves neither coordination nor endorsement by the relay.

Assess a claim →

Person or team responsible for validating, maintaining and arranging correction of an identified digital asset.

Caution: A name in an inventory must be confirmed before assigning responsibility.

Audit exposure →

A plausible alternative explanation tested against the same observations as the main account.

Caution: Naming an alternative does not make it equally likely; it helps identify a discriminating observation.

Preserve evidence →

A pre-defined criterion for ending research when the decision has enough support.

Caution: Ending a review does not remove uncertainty; remaining gaps belong in the report.

Preserve evidence →

The sequence of publications copying or citing one initial item.

Caution: Several reposts of one origin are not independent confirmations.

Preserve evidence →

Time between an event or update and its appearance in a searchable source.

Caution: Absence from a recent database may reflect an update delay.

Preserve evidence →

An address, number or device used to regain control of an account.

Caution: An unapproved change can preserve third-party access after a password reset.

Check an entity →

Permission granted to another account to view or act within a service.

Caution: Changing a password does not always remove existing delegations.

Check an entity →

The portion of an address representing the controlled name under a public suffix.

Caution: A subdomain or path can display a brand without that brand controlling the domain.

Audit exposure →

The advertised period for which a DNS answer may be cached.

Caution: It does not date domain creation or the actual start of a configuration.

Audit exposure →

Version received or captured before annotation, conversion, cropping or redaction.

Caution: What counts as original depends on collection; a download may already be transformed.

Preserve evidence →

Reference needed to interpret local time and compare it with other timestamps.

Caution: A timeline without zones can put events in the wrong order.

Preserve evidence →

Risk remaining after chosen measures have been applied.

Caution: A technical fix may reduce one avenue of harm without eliminating others.

Frame a decision →

Ability to undo an action or decision if an assumption proves wrong.

Caution: A public removal or payment may be hard to reverse; the check depth should reflect that.

Frame a decision →

A post whose distribution is purchased or amplified by an advertiser.

Caution: Paid distribution does not confirm advertiser identity or message accuracy.

Assess a claim →

Oldest occurrence identified within a bounded search.

Caution: It may not be the original publication when archives or platforms are incomplete.

Assess a claim →

Confirmation obtained using a number known before the request or found separately.

Caution: Calling a number supplied in the suspicious message is not an independent check.

Audit exposure →

Approval of a sensitive action by someone separate from the person preparing it.

Caution: Two clicks by one person do not create genuine separation of duties.

Audit exposure →

International identifier assigned to a legal entity in the Global LEI System.

Caution: Check status and renewal date; an identifier does not validate a transaction.

Check an entity →

Metric framework describing technical vulnerability severity through a score and vector.

Caution: Retain version and vector; severity alone does not measure business risk.

Frame a decision →

Estimate of the probability of real-world exploitation of a CVE over the next thirty days.

Caution: The percentile is a rank; it is not the exploitation probability.

Frame a decision →

CISA catalog of vulnerabilities known to be exploited in the wild.

Caution: Absence from the catalog does not mean absence of exploitation.

Audit exposure →

Potential match between a searched identity and a sanctions-list record.

Caution: Compare multiple identifiers and applicable legal text; a similar name is insufficient.

Frame a decision →

Documented search producing no relevant result within a defined scope.

Caution: Record query, filters and access; this result does not prove non-existence.

Preserve evidence →

Relationship in which several publications rely on the same information origin.

Caution: Copies of one document do not add independent confirmation.

Preserve evidence →