Name: Live Demo: Digital Risk Protection
Uploaded: 2026-09-23T16:16:05.959Z
Duration: 45 min 28 s
Description: Live Demo: Digital Risk Protection

Transcript for "Live Demo: Digital Risk Protection": Hello, everyone. Give every we've got close to a 100 people joining or signed up, so we'll give it a few seconds here as people are trickling in. Thank you all for signing up. We're looking forward to walking you through digital risk protection today. So we'll give it just give it one, maybe thirty seconds to a minute, and then we'll jump right in. Happy fall. Happy autumn for those who are in the Northern Hemisphere in The US. It's finally actually starting to feel kind of cold where I am in Michigan. I don't know how it is for you, Austin. A little bit warmer, though, for you in North Carolina, I think. Yeah. This week, it's starting to get into the seventies, which is nice because it's typically it's been nineties, eighties all summer and, cooling off at night. So yeah. I actually forgot that it was I didn't realize until today that fall started two days ago. So, yeah. Happy fall, better. late than ever. Happy. fall. Looks like we have a good number of you who have joined live. So, yeah, I think with that, we can go ahead and get started. Alright. Yeah. Let's jump into it. Again, thanks everyone for joining. My name is Austin Merritt. I work on the technical marketing team here at Recorded Future. Kathleen and myself are very excited to walk you through our our newest solution launch in digital risk protection. So Kathleen and I work in the technical marketing function here at Recorded Future. If you if you're not familiar with that function, it's essentially a field sales or field solutions engineer. I've been in threat intelligence now for six years and spent the last four years as a sales engineer. I've had the pleasure of being at Recorded Futures since June of this year, and I will pass it over to Kathleen to introduce herself. Yeah. Thanks, Austin. Excited to have Austin on the technical marketing team because now there's two of us. I'm Kathleen. I've been at Recorded Future for eight years, three years in technical marketing, five years as a sales or solutions engineer where I've worked with companies all across The US and Canada. And even further back, I started my career in US government as an intelligence analyst. So I've been in the cyber slash intelligence space for over eleven years now. So excited to be on with Austin to walk through our digital risk protection solution and answer any and all the questions that you all have. Thanks, Kathleen. And eight years is impressive. K. Congratulations. Kathleen. just had a just had a birthday too. So, happy, thanks. birthday to her as well. Alright. So, the agenda today, we're going to walk through a few different items before we get into the live demo, which will be the main part of our presentation. Gonna start with an overview of the threat landscape, what we're seeing, how it's changing, how we have unified brand and identity intelligence together into one solution. The different use cases that are covered in the solution, we'll get to the live demo piece and then some q and a at the end. But a few things to keep in mind, this will be recorded, so you'll have a follow-up after the webinar. There'll be dedicated q and a time at the end, but, we'll have that q and a session at the end, but you can also drop your questions, at any time in that q and a box. And, yeah, we may weave in a few questions into the the main section of of our discussion. There is a, resources in the docs tab, including signing up for our next live demo, which is CTI workflows using MCP, that is coming up. But we'll have a link to all of those, webinars that are coming up at the end of this presentation. Alright. So let's start with what's happening in the threat landscape and why it made a lot of sense for Recorded Future to unify, identity intelligence and brand intelligence into one solution, also including many use cases. The threat landscape is changing, has changed, but artificial intelligence is accelerating the time for threats to cause, you know, operational downtime, financial loss, and really, cause some damage to the brand and its executives online. So with what we have done with digital risk protection is looking across many different areas, covering many different use cases. So social media, mobile app stores, fraudulent domains, dark web, forms and marketplaces, code repositories. Because what we're finding is that these threats are more now than ever interconnected. Right? In the past, there may have been a, one off domain or or something that was a stand alone. Now these are very much interconnected threats, and they're coordinated as part of a social engineering attack. And, you know, what we need to be able to do is close that, the the speed gap. Right? This is happening very quickly. So the engineering has done a great really excited to show you some of the things engineering has done to prioritize and make the the alerts that we build into digital risk protection so easy to digest. And, you know, think we were keeping in mind how attackers are moving whenever we built the digital risk protection solution. An interesting stat, which is in the last year in The United States, $15,900,000,000 was lost to fraud. And, you know, typically, when we're talking about fraud and scams, it's oftentimes starting with some type of social engineering attack. In fact, if you look in the headlines recently, we're we're seeing a lot of things related to AI and social engineering in the headlines. And the fact of the matter is that social engineering has always existed since the end the Internet existed and even before. But now AI is amplifying that and it's the barrier to entry for an attacker is lower than it's ever been. And, also, the sophisticated threat actors, the nation state actors that organized cyber criminals, they're continuing to use these same techniques, but there's just more players in the field that are able to leverage these techniques. And oftentimes, they're going to use, AI or AI as part of a social engineering attack for their initial attack vector. And the fallout, unfortunately, for these types of attacks leads to downtime, data loss, financial loss, and reputational damage in many cases. So what what did we have in mind whenever we unified brand intelligence and identity intelligence? First thing is we need an ability to look across all these different channels on a continuous basis. Find every risky mention of your brands and executives across the open web, the deep web, and the dark web, and give your team the context to act on it very quickly. So the, areas that I've mentioned, domains, social media, code repositories, app stores, the dark web, these are all interconnected and going to be monitored as part of the solution. The high fidelity signals that we're providing in the platform are built on the AI triage agent, which we're going to talk about in detail today, which filters volume down to what actually needs to be actioned. So think about how teams are they're getting so much information today. They're overwhelmed with the amount of information. They don't know what to prioritize. That AI agent is really helping close the gap, in in providing the context and prioritizing the threats. The full context within the alerts, you we'll show you in the platform. You can get a very, very quick result in time to context, a summary of that alert, and taking action on that alert as well. And then finally, ROI built into the stop process. So there's some very awesome reporting features that are available in the platform. So not only can the analyst team be, you know, reviewing these alerts in the platform, we've translated our language into, you know, board level, type language so executives can understand where the risk lies as well. And just on the, the different use cases, what do these cover? We've we've already mentioned this. We're going actually gonna walk through every single one of these use cases, in the platform. So it probably makes more time more sense to spend time there in the platform rather than rattle off all the description here. So I will pass it over to Kathleen, to walk through the the next few pieces. Great. Thanks. So in terms of really expanding upon the intelligence graph and all of the background analytics that Recorder features been collecting for for a while, we've really done a lot more to make our capabilities for digital voice protection even stronger. That's where we've really spent the last two years scaling up and investing really heavily in these detection capabilities. So we're indexing as much as we can see over a 100,000,000 different source candidates per day in URLs, real time ingestion. And this is through a combination of both proprietary discovery, strategic partnerships that identify both the domain and subdomain, because the subdomain collection and registration piece is really important. This also includes looking at sources of registration, certificate transparency logs, as well as DNS records. We start as broad as possible and then filter in a few different ways. The main way is filtering through content analysis. So think of this as an initial assessment on how the page itself actually looks using the DOM to understand what the page is trying to accomplish, and then combining that analysis with machine learning, logo detection, OCR techniques so we can actually also match a logo to a malicious URL. And in the event that we've identified all of that, that's where we can sec suggest this domain should be taken down and can use our takedown services. The historic problem, though, with a lot of digital risk protection types of solutions is just the volume of alerts. And Austin already talked a little bit about some of the AI alert triaging capabilities. So we spent a lot of time making sure that our detection funnel is prioritizing and keeping only alerts that are truly relevant to your organization or that you can actually action, taking down the domain, taking down the impersonating account for an executive, for example. And this critical component of filtering, again, it will match to your brand watch list. Watch list is how we understand what you care about as an organization, from your brand names, executives, to your logos. And with this latest release, now we're streamlining this process from detection to alerts even further. And all that great engineering behind the Digital Works Protection will translate to really good outcomes for our customers. They've been testing and using Digital Works Protection now for the past five or six months, now just going full general availability. So any customers today can enable all of these use cases. Or for anyone on the call who's not a current customer, any demos that you have that are personalized to your organization will be showcasing these new capabilities as well. So with the new digital voice protection capabilities, our customers are reporting a 90% reduction in incident resolution time, and this is continuing to contribute to overall savings of about $300,000 in annual savings from using our digital risk protection solution. So that's enough slides for us. We're gonna spend the rest of the time here walking through all of these use cases live, and I'll hand it back over to Austin to go into the platform. Thank you, Kathleen. Alright. So get my screen share going. And, yeah, the that the metrics that Kathleen mentioned there at the end, those are actually trackable within the platform. So if there's some time at the end, we'll show you, you know, the impact and metrics dashboard where all this kinda comes together, in in a really nice overview. But you can also access reporting directly here in the platform. So let's talk about the high level. Like, what are we looking at here when we land on the digital risk protection solution? You get complete visibility into the dashboard, and you begin to understand how Recorded Future is populating information on your behalf. So this is a very well thought out process, which Kathleen did could just walk through, kind of some of the logic behind that. But the visualization here is, really, it does start with your assets. So what what are we protecting, within your specific watch list, your domain watch list, your brand name watch list, and also taking into account not just the names of the domains and the brand names, but, accounting for advanced logo, analysis as part of our evaluation as well. Right? There there are multiple indicators that we have to be considering whenever we're, fine tuning through the large volumes of data, that we're we're finding. But it does start at the organizational level, the brand name level, the executive level to understand what are we actually collecting against, what is our benchmark for where we wanna start ingesting information. So from here, when we begin that broad collection across the open web, deep web, and dark web, we call those our detections. So those are things that are tangentially related to those assets or those watch lists. But where the alert logic begins to filter down these these into alerts. So you actually have both of these available in the platform, but you're only going to be alerted to the things that are alerts. Right? You you can toggle between both of these, but the alerts have actually have some type of logic attached to it. And you can look at the different alert, categories if I go into malicious site monitoring configuration here and see what we are the different indicators that we're hitting on. So in the case of domain monitoring, which I'm gonna start with today, there's a couple of things that we have done on the back end to make this prioritization so much easier to understand. Now you'll notice that with the alert interface here that there are multiple indicators that can trigger an alert. But you'll also notice that at the top here, there are the suggested takedown alert or assessment and the review recommended. So whenever multiple indicators, at least two have been triggered, then that's going to, prioritize things into this suggested take down bucket. So, I mean, at a minimum, you're gonna wanna have review recommended. Meaning, review recommended means it hasn't met the threshold of saying that we would suggest to take down yet, but there are pieces of evidence there. And all these other, indicators are available as alerts, but you may find that they're noisy, so you could turn those off. But most of the time, what we've been finding from our customers recently is that they moved from maybe hundreds, in some cases, thousands of really noisy alerts to extremely actionable, intelligence because there's multiple indicators that are telling them this is a suggested takedown. So we'll get into the alert itself. But really this the the engine behind what's making this so intuitive and prioritized is the AI triage agent. So this is something that is built in here into malicious site monitoring, also as part of the, dark web brand monitoring. In fact, this is going to be, added in for these additional use cases. But it is the engine that's powering the, the AI, filtering for a suggested takedown or review recommended. So the legwork here is done in the body of this triage agent. However, you can add in some custom text yourself. So as an example, let's say that you were an analyst and you were seeing a so multiple false positives, in the same pattern. Let's say that there was a, your team was out or your whoever responsible for registering domains was consistently going out and registering typosquats under mark monitor. You're seeing a lot of false positives there. Or maybe you want to add into this prompt that, anything that is registered by mark monitor, please do not escalate those alerts. So you can add in multiple prompts into this, prompt box here to think of this as a an analyst that is working on your behalf and is going through these alerts and looking at these and and filtering out the noise for you on your behalf. So what does that look like within the alert itself? So I have, gone down here into the alerts queue. I have filtered by high priority, and I've got this filtered by suggested take down. If I click into one of these alerts, for example keep in mind too that in this environment, there's a lot of different brands we're showcasing. So the the numbers you may be seeing is is probably not an accurate representation of what you may see for one organization or brand. But there are multiple brands here in my demo environment. So you're gonna you're gonna have a higher volume of alerts here. But what you see immediately clicking within this alert is that there is three immediate takeaways. One is the verdict, which is the suggested takedown from the AI triage agent. You also get a summary. So why did we actually raise this alert and suggest it for a takedown? It's mimicking the Huawei official site. But then you also have the ability to immediately request this for a takedown. Now you may want to review more information within the alert, which we'll we'll get to that piece. But as far as the quickness in which you can respond to a threat, you know, we've taken the leg work out of analyzing this, and then populating this for a takedown. The verbiage here is already ready for you ready for you and ready to go, and you could submit this for a takedown immediately, to the, you know, registrars or or hosting providers that that are there in in the takedown queue. Now you can see more information provided here within the assessment. Suggested takedown, the AI triage agent, of course, determined this was likely malicious. But you can see the indicators that powered that suggestion. There was a login form. And also, this was detected as exhibiting suspicious behavior by our HTML content analysis. You'll notice some TTPs that were associated with this specific domain. Maybe there's DNS records, you know, mail server or a record or other records that we've identified for that domain. And then we have a screenshot that is available. You can enlarge that screenshot right here in the alert interface. You could also open this into a full page view if you wanted to. And then finally, just other actions to consider. The take down, we we've mentioned. But if you want to report this to Google Safe Browsing or open this in the sandbox, so if you wanted to view this outside of your browser and navigate the domain that way, you could do so. Last thing I'll mention here before passing over to Kathleen is the reporting that I mentioned. We do have the ability to I can probably download this very quickly and show you what this looks like. So you can get an executive level report immediately, with all the information and also some of that ROI tied into the threats that we've identified, across DRP, so across all the use cases. So with that, I will pass it over to Kathleen. Great. Thank you, Austin. One piece I did want to mention too with the takedowns is that we do also offer a managed takedown service. So if the takedown let's say you have three that are flagged per day, as an analyst, you have full control to submit that takedown. It goes through our takedown portal. You'll be able to track all that activity in the takedown activity tab. However, we also offer a managed service. So if you would like us to do that initial level of triage, submit that on your behalf. That is available as well. One of the use cases I'll walk through next is more focused on identity exposure or the continuous monitoring for credentials that have been stolen, especially from malware logs. Of the 500 or so detections, we only have about a 100 high priority identities that have been exposed. And very similar to what Austin just walked through for the malicious site configuration, we have a lot of flexibility on when I get an alert. I definitely recommend our default, which is anytime a user can log in to a sensitive technology, think of VPN. If there's a VIP exposure, so we have a separate way of monitoring and tracking VIP level credentials that you would want to know about right away, and also from a Steeler malware perspective. There are the options that have even more custom types of alerts or configuration. One of the most common ones is looking for anytime there's a credential that has been stolen that, again, could log into a VPN and also contains unexpired cookies. But there are a lot of other criteria that you can use to, again, really customize your exposure, although using the default for sensitive technologies and VIP exposures is definitely what I recommend. We'll prioritize based on all of our high priority exposures. We can see a few that have had the VIP exposure flag. So clicking into this specific user, we'll see the full AI insights. So, again, why is this user have, or what other credentials have been stolen? Because as you all are probably aware, when the info stealer malware is infecting a user's computer, it has access to not just the username and password that can log in to a corporate account, but anything else tied to that user. So we will include the full exposed credential, the email, the password, as well as flagging whether or not cookies are there as well as active cookies, which, again, we can filter on as well. For any of our customers who want to have the clear text password, that's not available by default, but you can submit a legal form, and we can make those passwords available in clear text. One of the other examples is more looking at credentials that have been stolen that can log into specific technologies. So in this case, we're seeing this specific user can log into a production site, the victim IP address, as well as a full compromised host details. So addition to the incident report we just walked through, under exact understanding exactly where the user was impacted as in what was the file that they downloaded that then caused the malware to be successful and to communicate those credentials back to the threat actor. In this case, LUMA c two was the malware family. And this is where combining the capabilities we have with the source protection and then our more detection based use cases with cyber operations, where our team will go through, you know, the latest click fix campaign. That's actually one of the docs in the resource section is the recording on tracking click fix, but also providing hunting packages. Because it's not enough to just reset the password. That's obviously very important. But you also want the capability to actually eradicate and remove that malware. The biggest value, though, of using any of the identity exposures is going to be enforcing password presets right away. And this is where we have a very robust identity API available, and we have a variety of prebuilt integrations as well, all of which you can access in the integration center. So in this case, I'm only looking at our identity access management integrations. We have a few prebuilt integrations, including Microsoft Entra ID, and then two for Okta, the base Okta capability, as well as Okta workflows. All of this is included with digital voice protection, and you can easily set up and configure right within recorded feature. So in addition to continuously monitoring for exposed identity credentials, this oftentimes relates into code repository monitoring. And the reason why I mentioned that is there are times I've been doing research for prospective customers or for customers where record feature has found credentials that have been stolen for a developer. Obviously, the risk there is if there's sensitive, private, internal only code, then a threat actor could log in and use and access that code. But record feature can also continuously monitor for code repositories that have been made public that probably shouldn't be. And similar to other configuration, we can flag whether or not there has been an AWS key leak. So using pattern detection to say, yep. This has been publicly exposed, alerting you to this within minutes, and then making sure you can take that down. And we also provide custom keyword searching. So whether that's an internal project name that only your company has to an internal focused facing domain, you can update and very easily configure our full code repository monitoring. Luckily, I don't have any high priority findings. But for some of our more moderate findings, this will include whether we're looking at the specific key leak. So in this case, some of the keywords that matched here was login and password and username. We'll always point you back to the original GitHub link so you can look at that GitHub itself, full evidence, and what would the watch list mention was as well. Now as the code repository changes, as there's commits made, this alert will continuously look for those new commits as well. So, hopefully, then when this gets taken down or has been removed or made private, then you will no longer obviously see that alert appear in your environment any further. So those were some use cases really focused on our identity exposure. So, again, we can integrate directly into Microsoft Entra ID, into Okta, or we have our identity API, which you can access as well, as well as our code repository monitoring. So I'll pass it back over to Austin to walk through a few of our last use cases here that rounds out digital protection. Oh, you're on mute. I'm on mute. Thank you, Kathleen. Appreciate you walking through identity and the code repository use case there. Actually, something I wanted to share with the audience that I found pretty interesting on code repositories. There was a study that I had shared with Kathleen that Anthropic did last year where they looked at a 128,000 code repositories, and they found that 20% of those were being used, or they had used some kind of agent or LLM to push code into that repository. It was leading to a lot of, inadvertently exposed data. So that use case is is more important than ever, and I think the engineers have done a really good job of, of, you know, helping our customers prioritize things. We've got a ton of really positive feedback, on that use case as well. Alright. So the next use case that I wanna walk through is impersonations. And I'm actually in a sandbox environment that I've built out for this use case just because there's some, executives in here who wanna protect their identity. But, the the functions in here are all the same. And what I want to start with is understanding what are we looking at from when it comes to social media and who are we protecting. It's not just the executives, it's the brand as well. Looking across platforms like Facebook and Instagram and YouTube and TikTok and x, where we know that threat actors are leveraging the brand and executives of individuals to try and impersonate them and begin some kind of social engineering campaign. So where I wanna start is within the assets for the executives, we can add in, their name here. We also have the meta watch list, which is the primary watch list that is powering our social media detection. So there's some crossover where brand names are are looking more broadly beyond social media, where the the meta watch list is, scanning on a more frequent basis to make sure that we're we're covering social media, as those threats appear. Now as far as the escalation of alerts, from a, executive standpoint or from a impersonation standpoint for the brand, we do have a, several different assessments that are available for this use case. But we start at the lowest level, meaning that is there a name match? Is there a a bio match? And then we gradually escalate that to severity level. So some of the things that we're looking for are not just the name and maybe mention of the company in the bio. There's other things that happen on social media that account for fidelity, of that specific alert. So how long has that account been existing on social media? What's the number of followers that are that is attached to that account? What is that account have a verified status? So these are things that we're taking into account when we're rating these alerts and we're prioritizing them. Alright. So from here, I can have some of the same filters that are available for the other use cases. I wanna filter by high priority in this case and click within this specific alert. There we go. And then within the alert queue, you'll notice that, well, one, on the the the table, we have, you know, the entire list of alerts with a screenshot of the individual or the brand, wherever that was captured. You'll get a summary just like you do with these other alerts and, where we found that account. This one had was found in enterprise name and bio fit biography fields on Facebook. And then, of course, the the ability to, look at this information in more detail and then kick off a a take down from within this workflow as well. So, you know, key takeaway here is getting quick action and visibility into these social media platforms where the, social media impersonations are often starting or part of a larger attack chain. So from here, I'm going to dive back into my demo environment and walk through the dark web piece, or the. dark. As you bring that up, I did just wanna mention, especially with the impersonation use case, that even some of the smaller customers I've worked with in the past will have some impersonation alerts. I think of one manufacturing customer I worked with where their cofounder had no Internet presence, but there were a decent number of fake x or Twitter accounts as well as Facebook accounts. And we were able to discover those and, as Austin just walked through, also submitted takedown request. So even some of the smaller companies, yet anyone can try to impersonate anyone now here a days, especially with social engineering. And with all the personality information we give out as well, much easier to accomplish some of those use cases. So wanted to mention that just for the impersonation use case. Yeah. Absolutely. Even, like, I think if you don't have a social media presence, you become even easier to impersonate and that extends to all sizes of organizations. So that's a really good a really good point there. Alright. So finally, moving into dark web, the dark web mentions. So Kathleen walked through the identity exposure, which of course is, a key part of our dark web offering. But there is more that happens on the dark web than just credential exposure. Right? There are mentions of your organization. There's cyber criminal forms in marketplaces where there are there's also covert channels like Telegram that we consider to make up the ecosystem of what we refer to as the dark web. And there's a ton of activity happening on these forms of marketplaces outside of credential compromise. There's access for sale. There is, trafficking of of goods and data. And, there's also a, you know, a very interesting relationship between initial access brokers and how they sell, access to ransomware ransomware threat actor groups. So within this use case, you'll find, couple different selections of alerts that you may come across. So the first type that I want to, walk through would just be a malicious for a mention on the dark web. So I'm gonna filter here by malicious dark web formation and show you what you could expect to see. Worth mentioning too that within this use case, we also have that triage agent that is available for you. So if I go into the dark web monitoring piece and I scroll down the triage agent, you'll see that there's a red readily available, triage agent that has already been accounted for. But, again, you could add in your custom prompts here just as you could for that domain use case. Because keep in mind, just like the open web, the dark web is full of information. And we oftentimes, see that a brand is named many times, but the context may be missing. So if you want to add in, hey. I only wanna see the context of my brand as it is associated with access for sale or some type of you know, if it's for any other data associated with that brand for sale. Because if you have a if you were a, you know, very well known brand name, you may get mentioned multiple times. So that context is really important. So with this alert here, we've got the AI verdict of a malicious dark web forum mention, and the the the wording of the the wording selling, the reference to valid FortiGate SSL, and super super admin accesses, were for sale. And this was happening that mentioned of the, Huawei brand here on dark web forums, a cyber criminal marketplace, and you get the actions to consider. So also as with the domain use case, you can open these alerts in the sandbox. So you can pivot outside of, Recorded Future and see what is actually happening. But you don't necessarily have to do that. Recorded Future has built in all of the, and captured all the information that's happened in the full thread. So you get a really nice snapshot here of where the mention of the brand was or the, the keyword that you were monitoring for, but you can open this full thread and get more complete information, and context around that thread. Yeah. The to mention as well, it's all being translated. In this case, this one is in English, which I can read. But for those of us who don't know Russian, which Austin does know Russian, for some other languages, we are automatically translating as well. So wanted to just throw that out there. So you don't have to know Arabic, Farsi, Mandarin, all the other languages. I wish I spoke, but I don't speak. So wanted. It's mention really that. it's a very cool use case. You would actually see, if this was in Russian or Mandarin, which is very common, for dark web activity, you would have a an option to trans. It would automatically be translated for you, but you could even pivot back and forth, between the languages, which is really nice that it's all it's all there and done for you. So in another, really interesting use case, I think an important use case is monitoring for ransomware activity on ransomware data leak sites. So you can filter here, within the assessment filter to look for mentions of organizations, on the ransomware data leak site. So the basically, the way this works, if you're not familiar with how these name and shame sites work, is that a ransomware group will name a victim that they have, you know, encrypted their files or they've, you know, shut down computers at that company. And they have stolen information and they've either posted a little bit of a teaser of that information on the ransomware data leak site, or what's more common is that they're threatening to release all this information to the public if some kind of ransom is not paid to that organization. And the impact to organizations, obviously, is is downtime, financial loss, but it it's not just the naming of your organization. There may be a third party. So there is third party, fallout from these attacks as well. If they've, maybe tapped into one of your vendors and they've attacked them, maybe that poses some risk to your organization as well. So we monitor all the the ransomware data leak sites. If you click within the alert here, you're going to see, some context around, you know, the company that was named here, who was the ransomware group that, posted them on the ransomware data leak site, and then some actions to consider from here. Now this is also going to tie into, a cyber operations, which you could actually pivot directly from here. This is a digital risk protection alert and dark web monitoring. But if I were to click on the gentleman ransomware group and this intelligence card, it's going to take me to this page for the ransom group. So similar to what Kathleen showed for that malware, you can also access other intelligence cards, of course, if you have, cyber operations within the this ransomware card, you're going to see, the targeted industries that this ransomware group is after, a complete summary that's available within recorded future AI insights. You get to see the latest intelligence from the insect group about this ransomware group. And also, there's some detection rules here. So if you wanted to launch a threat hunt to see, maybe there was a third party you've worked with that was exposed and now you're concerned about, hey, was there spillover to my environment? You do have the ability to, you know, initiate a threat hunt, from this page itself. So for the live demo portion, that is going to conclude, but I do have a few more things that we want to talk about here towards the end. One piece that, you know, we is not worth mentioning is just what what are our customers telling us today? What what have they been hearing? So a few testimonials, one from a global automotive manufacturer. They mentioned that they were able to see their false positive rate drop significantly, hundreds per week to a single incident. So getting high value out of the alerts. Incident that Kathleen and I, talked about recently was where a financial services company told us that they got it alerted to a dark web alert and a malicious domain alert about the same threat. So it and we were the first vendor to notify them. They were immediately able to take action and and escalate from there. And a government agency reported that the DRP experience is feeling more manageable for their teams, better aligned to their use cases, and a global insurance provider confirmed they turned off the legacy code repository alerts in favor of the new DRP playbook alerts. And, that's allowing them to, alert to the develop when developers are improperly pushing comp company code to coding repositories. Alright. And I will so for the q a q and a and wrap up, I will pass it over to Kathleen. Sounds great. So, yes, there's been a few questions that have popped up, especially related to integrations. So did wanna mention that for any of our current customers who are using our brand intelligence and all of those alert capabilities in their different integrations from Splunk to XOR, etcetera, is the team is working on releasing the API version of these digital risk protection use cases by the end of October. There'll be other integrations that we'll be rolling through, but this will include Google SecOps and XOR and all the other integrations that you all are using as a part of our legacy system. So those will be released soon. And then once those are released, it'll be really easy for the team once those workflows are operationalized in those integrations to be able to turn off some of the legacy alerts. As I mentioned, we are not going to be, deactivating some of those legacy alerts until much later into next year, obviously, making sure that the digital rich protection use cases are working for everyone. There's another question about more of the takedowns versus having the managed takedown service. So in a so customers today can submit a takedown request if they have the takedowns package using the submit takedown. And as Austin walked through, it will automatically populate all the evidence, and that will go to our takedown provider, and you'll be able to track from there. We also offer a managed services offering that would include managed services for all of those use cases. So if you wanted one of our analysts to triage the dark web alerts, the malicious sites, the executive impersonation, our analyst can triage that first and either just submit the takedown request on your behalf or escalate. So we're really flexible on that support model. Yep. Another question on see, some of the integration pieces is yes. All of the integrations we have, including for Microsoft Sentinel, when those APIs are fully done, that integration package will be updated, meaning you won't have to manually configure anything. So that will be available out of the box over the next few months. For those customers, we'll make sure to provide updates in our support site as well as the community as well. See some other questions here. Question about the ClearText passwords. So, yes, in the identity exposure, we are able to provide clear text passwords. As mentioned, it's not available by default. We just have a little legal form just because, understandably, if you have the clear text password, just wanna make sure that that is all, following legal standards, but that is available for customers as well. Those are most of the questions that I'm seeing, so thank you all for those. So let's officially round up the live demo here. So report feature, we're really excited. We were just recently named a leader in the latest Forrester Wave for external threat intelligence service providers. We were evaluated alongside dozens of other intelligence providers based on customer feedback, our current offering and strategy, and we did come across come out on top as the highest possible scores for three specific strike strategy criteria, vision, innovation, and roadmap. We also reviewed and received top scores for nine current offerings, including deep and dark web, a lot of which is based on what Austin just walked through with our continuous monitoring of various ransomware source and sites, dark web sources. And then as well, something we didn't really mention was the insect group. So having the insect group, their personas on these different dark web sources also providing some more context to all of the monitoring that we have capability wise. But really excited to be named that Forrester Wave leader. In terms of some upcoming events, for any current customers, we have a deep dive experts quarter next week. You can sign up with the QR code here. It's also available in the community. We also have an upcoming product roadmap session that we'll be hosting on the October 15. And then be sure to sign up for our next live demo, which is focusing on CTI workflows using MCP. In the chat as well, I have a sign up for a virtual capture the flag. So this is available to anyone. You don't have to be a current recorded feature customer. If you sign up for the virtual capture the flag, join the session live, it will be the last link in the docs tab. So if you click on that link, you'll be able to sign up. You will then also have access to the Recorded Future platform for a few weeks following the virtual capture flag, which Austin and I will be hosting in the next few weeks. Overall key takeaways, we talked about how Recorded Future can see not just a lot of the collection that we have from domain registrar, certificate transparency logs, dark web sources, all the meta and social media sources, but we're able to prioritize what matters, helping our customers act quickly, take that down. And as we move into the more agentic workspace, a lot of what we just walked through today is gonna be available in an agent tick form, a lot of which we've already built into the platform with the AI alert triage, but also making all of those great capabilities accessible via your LLM of choice, whether that's Copilot, etcetera. Wanna say a big thank you to you all. Thanks, Austin, for running through so much of the demo, and thank you all for all of the great questions. If there are any questions that we didn't answer, which I believe we answer everything, we can follow-up with you all individually. But thank you all, and hope you have a good rest of your Wednesday. Thanks, everyone. Have a great day. Appreciate it.