Relevance, outputs and a worked example
01 · RELEVANCE, BROAD PRESSURE VERSUS DIRECTED INTEREST
Two axes combine into a prioritization context.
| Exposure relevance | Behavior relevance |
|---|---|
| Generic Internet exposure | Touch / scan |
| Technology-profile exposure | Authentication or exploit attempt |
| Sector-profile exposure | Repeated validation |
| Customer-linked exposure | Interactive access |
| Post-access objective behavior |
A generic scan against a public service has low customer-specific relevance. Repeated credential validation against a customer-linked profile followed by deeper interaction is materially different — but still requires evidence before claiming targeted intent.
02 · WORKED EXAMPLE — TARGET-SIDE CREDENTIAL VALIDATION
Facts and interpretation are kept separate.
FortiBleed evidence
Are successful authentication events followed by exploitation, or are actors validating and leaving?
Surface context — a controlled appliance-exposure profile separate from production.
Observed — a large authentication volume over time; successful validations with no subsequent interactive exploitation in some cases; repeated patterns and infrastructure relationships.
Assessed — evidence of a validate-and-leave workflow consistent with access-market activity.
Limitation — third-party feeds offer limited visibility into this activity.
Unknown — the actor, the buyer or the intended victim; targeting of any specific production environment.
Output — an Access Finding, production-log pivots, detection guidance and a strategic briefing on access-market behavior.
03 · SOC, CTI AND HARDENING OUTPUTS
Three outputs from one mission.
SOC
- alert with Finding context
- source and target context
- recommended triage
- links to supporting material
CTI
- repeated infrastructure or behavior
- confidence and relevance
- campaign or access-market hypothesis
- Research context
Security engineering
- hardening recommendation
- detection or hunt
- log-source review
- exposure-management priority
HIIH does not merely count edge traffic. It helps the organization decide what the traffic means and what to do next.