AccessExposureEngagement

Mission patterns and Findings

01 · FOUR PUBLIC-SECTOR MISSION PATTERNS

Each mission maps to a Surface, an output and a qualification.

Sector edge watch

Question — what is testing and validating access against a selected class of exposed infrastructure? Surface — Contact Points and applicable targets representing an approved edge profile, with regional or sector placement. Outputs — Access and Exposure Findings, recurrence and infrastructure patterns, member guidance, detection or hardening recommendations. Qualification — this does not prove every source is targeting the sector.

Engagement

Controlled post-access collection

Question — what tools and behaviors appear after an operator believes access is useful? Surface — approved Live Hosts under an engagement policy. Outputs — command and artifact analysis, Engagement Findings, detection content, incident-preparation briefings.

Campaign or infrastructure correlation

Question — are repeated behaviors or infrastructure characteristics appearing across defined observations? Outputs — correlation within the authorized dataset, confidence and provenance, analyst review, possible public or member-only reporting. Qualification — no default claim of cross-deployment or pooled intelligence; any pooling requires deployed governance and engagement-specific terms.

Research and defensive preparation

Question — what can the program publish or operationalize from primary observed material? Outputs — technical report, indicators and TTPs, detection and hunting guidance where produced, sector brief, doctrine or exercise insight.

02 · FROM SURFACE OBSERVATIONS TO CERT FINDINGS

The output is a structured Finding an analyst can act on, not a raw event dump.

Defined missionscope · authority

→

HIIH Surfaceobserved activity

→

Structured Findingcontext · confidence

→

CERT analysismember note · alert

HIIH FindingExposure Illustrative example

Confidence Medium

Observed activity: Repeated exploit probing and credential validation against a sector edge profile across a defined window
Mission relevance: Sector-relevant
Why it matters: Recurrence across the authorized deployment strengthens a sector-pressure assessment; it does not prove every source is targeting the sector
Supporting material: Request sequences, authentication attempts, infrastructure recurrence, client characteristics
Suggested action: Issue member guidance and detection context; pivot member production logs for the observed pattern
Delivery: Surface Console · MCP · API — pull-based

A Finding carries mission context, observed facts, assessment and confidence, relevance to region or sector, supporting observations, a disclosure level and recommended member action. HIIH does not imply a complete disclosure or rights engine is enforced automatically unless it has been confirmed for the program.

03 · REGIONAL AND SECTOR RELEVANCE

Relevance is designed into the mission and qualified in the Finding.

Location of exposure can influence what is observed but does not prove actor origin or intent. Sector-specific personas or exposure profiles can raise relevance when safely designed. Repeated behavior across authorized Surfaces can strengthen an assessment, and non-public placement can produce high-confidence internal signals for a participating organization. Analyst review remains necessary throughout.

Axis	Range
Breadth of collection	single Surface → sector program → regional program
Strength of relevance	Internet-wide → profile-specific → customer-directed → confirmed / internal

The two axes are independent. Wider collection does not raise relevance, and a single Surface can produce a high-relevance internal signal. HIIH does not describe a national sensor program unless one actually exists.