In the intelligence world, a tearline allows information from a report to be shared without revealing sensitive sources or methods. It protects sources and lets a wider audience benefit from the intelligence.

This has been our inspiration for Tearline. In cybersecurity, we’re not limited by information. There’s a fire hose of data being blasted out daily, whether it’s about our adversaries, recent attacks, research or tooling. The news cycle is short and moves fast, and if you take your eye off the ball, you feel like you’re behind the curve.

But from this noise, we need signal we can act on. And we need that signal put into context for defenders. Information needs to be professionally reviewed, analysed and shared in a consumable format. This is at the centre of what we do at Tearline. No hubris, no FUD, no puff pieces. Just professional analysis, easily consumable and built for the blue team.

I’ve spent the past 19 years working in security across the military, government and the private sector, with the last 12 years in cybersecurity. I’ve run CTI programmes, led SOCs and worked as a CISO. One theme was clear to me: understanding our adversary gives us an advantage. It’s not optional; it’s essential. And with the pace of advancement from our adversaries, we need every bit of help we can get.

But if you’re looking for a quick fix, we don’t think there is one. There’s no magic configuration or IOC feed that will scratch this itch. To keep up with today’s attackers, we have to do the hard miles. We have to go deep on their tactics and techniques, use the right technologies and master the tools we have in our arsenals. Tearline is focused on this deep analysis and understanding. Not clickbait headlines. Not FUD.

On tooling, we believe that vendors are central to our fight against the adversary. Love them or hate them, they provide the technology and services that we rely on every day. They’re undoubtedly essential. You’ll see us partner with vendors and recommend tools from time to time. These are carefully vetted and selected solutions that we stand behind and genuinely believe can help. In many cases, they’re technologies that we’ve deployed and operated for clients.

It’s not all about technology though. In fact, sometimes that’s the easiest part. Organisations are complex, with overlapping and sometimes contradictory objectives. Some of the biggest wins come from people and culture: bringing teams together around shared priorities. We understand this and shape our analysis around the people, the technology and the culture. There are no quick wins.

And for us to be successful, we need to learn fast. Our adversaries are proven innovators and inventors. Where they need to, they adapt, they change and they overcome. That doesn’t mean the old techniques aren’t still used, though. It means defenders need to be aware of the old and ready for the new. As technology advances, we need to anticipate how attackers might exploit it.

We’ve started Tearline for defenders who want signal over noise: the CISOs deciding how to assign their limited budgets, the SOC managers looking for an understanding of the latest TTPs, or the engineer who needs inspiration on how to tune a tool so that it defeats an adversary. But it's also for people working in governance, risk and compliance, legal, finance, or any other part of an organization where security plays a role. You don't need to be a technical specialist to find something useful here.

The origins of our approach come from our time in the military. There, intelligence is used day to day and embedded in operations and planning. It helps shape decisions and gives an advantage over adversaries. We believe that, done well, intelligence can offer the same impact to you.

I hope you enjoy our work and find Tearline useful.

Steve