What Is Pre-Attack Intelligence? Predictive, Evidence-Based Security Before the Attack
This is a div block with a Webflow interaction that will be triggered when the heading is in the view.
Pre-Attack Intelligence is the predictive, evidence-based discipline of observing, validating, and acting on adversary preparation before it is used in an attack. It focuses on MITRE ATT&CK TA0042 Resource Development, produces Indicators of Pre-Attack (IoPAs), and is the foundation for Pre-Attack Prevention, measured by Mean Time to Preempt (MTTP).
Every attack has a setup phase. Adversaries register domains, issue certificates, rent hosting and build impersonation sites before anything touches a victim. This guide explains how Pre-Attack Intelligence turns that setup into evidence, how it differs from threat intelligence and exposure management, and how teams act on it through Pre-Attack Prevention.
Malanta is the outside-in half of preemptive security. Exposure management and validation tools show defenders their own weak points: unpatched assets, misconfigurations, reachable attack paths. Pre-Attack Intelligence shows the other side of the board: the attacker's infrastructure while it is being staged. Used together, the two answer both preemptive questions. Where are we weak, and what is being built to exploit us?
Gartner expects preemptive cybersecurity solutions to reach 50% of IT security spending by 2030, up from less than 5% in 2024 (Gartner, 2025).
How Pre-Attack Intelligence works
Pre-Attack Intelligence works in three steps: observe, validate, act. Analysts and systems observe adversary preparation in public infrastructure such as domain registries, certificate transparency logs, DNS and hosting. They validate whether the artifacts belong to real attack preparation. Then they act, delivering Indicators of Pre-Attack that security teams use to block, monitor, investigate or take down infrastructure.
Observe
Preparation happens outside the victim environment, which is why it is visible from the outside in. Sources include domain registration data, certificate transparency logs, passive DNS, hosting and ASN data, web content and page fingerprints. Security teams in the US, Israel, Canada and Singapore ask the same question: who is building infrastructure against our brands, executives and suppliers right now?
Validate
Raw signals are noise. Validation follows the same Collect / Correlate / Validate / Act sequence used on the Pre-Attack Intelligence hub. Artifacts are correlated through shared registrars, name servers, certificate patterns, hosting, page kits and identity attributes, then tested to confirm adversary setup rather than coincidence or routine activity.
Act
The validated result is an Indicator of Pre-Attack with context: what was observed, why it indicates preparation, evidence strength, and the recommended action. Teams can block, monitor, investigate or take down infrastructure through the platform and existing controls.
What TA0042 Resource Development looks like in practice
MITRE ATT&CK catalogs adversary preparation as TA0042 Resource Development. In practice, that work leaves concrete, observable trails:
- Domain registration (T1583.001 Acquire Infrastructure: Domains): lookalike, homoglyph, typosquat and combination domains targeting a brand, executive, supplier or industry.
- Certificates (T1588.004 Obtain Capabilities: Digital Certificates; T1608.003 Stage Capabilities: Install Digital Certificate): TLS certificates issued for staged domains before they go live.
- Hosting and servers (T1583.003 Virtual Private Server, T1583.004 Server, T1583.006 Web Services): infrastructure rented or configured for phishing, payload delivery, redirects or command and control.
- DNS configuration (T1583.002 DNS Server): name servers and records that link staged domains to delivery infrastructure.
- Lookalike and impersonation infrastructure (T1585 Establish Accounts, T1608.005 Stage Capabilities: Link Target): cloned login pages, fake support portals, social and email accounts impersonating the brand.
- Capability development (T1587 Develop Capabilities): phishing kits, malware and tooling built before deployment. Anthropic's June 3, 2026 analysis of 832 observed threat actors found that 69% used T1587 (Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator).
Attacker infrastructure is the most observable part of Resource Development, which is why Pre-Attack Intelligence starts there.
Pre-Attack Intelligence vs threat intelligence vs exposure management
Pre-Attack Intelligence, threat intelligence and exposure management answer different questions. Exposure management asks where your own environment is weak. Threat intelligence asks what attackers have already done, usually through Indicators of Compromise. Pre-Attack Intelligence asks what attackers are building right now, before it is used. The three are complementary layers of a preemptive security program.
The table below compares the three layers. Malanta is the example Pre-Attack Intelligence vendor. Exposure management vendors such as Tenable, XM Cyber and Cortex Xpanse cover an organization's own weak points and attack paths.
Read in plain terms: Pre-Attack Intelligence answers "what is being staged against us now?" from outside-in attacker infrastructure. Its primary output is Indicators of Pre-Attack, and its key metric is MTTP. Threat intelligence answers what adversaries have already done. Exposure management answers where the defender is weak. Pre-Attack Intelligence extends the stack. It does not replace detection, response, CTI or exposure management.
Indicators of Compromise also arrive late. Censys measured a median lifespan of 5.0 days for observed Cobalt Strike services in its 2025 State of the Internet Report. By the time many IoCs reach controls, the infrastructure they describe may already be gone.
What are Indicators of Pre-Attack (IoPAs)?
An Indicator of Pre-Attack (IoPA) is a validated signal that adversary infrastructure is being prepared before it is used. An IoPA can be a staged domain, certificate, server or impersonation page, delivered with evidence and context: what was observed, why it indicates preparation, how strong the evidence is, and which action it supports.
An IoPA typically carries:
- Artifact (domain, certificate, IP, page)
- Related infrastructure cluster
- TA0042 technique
- Targeted brand, asset or sector
- Evidence and confidence
- First observed timestamp
- Recommended action
See the Indicators of Pre-Attack reference and the anatomy of an IoPA.
An IoC records what already happened in a victim environment. An IoPA records what is being prepared outside it.
Take a lookalike domain that spoofs a regional bank. The raw signal is the registration, a new TLS certificate, a server in a hosting range and mail records being configured. Correlation asks whose behavior it matches, whether it is relevant to that bank, and how ready it is: a live certificate, a cloned portal and send-ready mail records mean little lead time is left. Validation corroborates those signals and weighs the evidence. The result is an IoPA the analyst can act on at once: block the domain and request a takedown before customers are phished.
An IOC is high confidence about the past. An IoPA is probabilistic about the future: probabilistic in outcome, built on observed artifacts.
From intelligence to Pre-Attack Prevention, measured by MTTP
Pre-Attack Prevention is the operational practice built on Pre-Attack Intelligence. It uses validated Indicators of Pre-Attack to block, disrupt or take down adversary infrastructure while it is still being prepared. Pre-Attack Intelligence supplies the evidence. Pre-Attack Prevention is how the organization acts on it, before phishing, fraud or intrusion reaches users and systems.
That operational step sits left of breach: action during the setup window. See how to operationalize Pre-Attack Prevention and how Pre-Attack Prevention works.
What is Mean Time to Preempt (MTTP)?
Mean Time to Preempt (MTTP) is the average time between observing validated adversary preparation and taking action against it, such as blocking, monitoring or takedown. Shorter MTTP means the defender used more of the setup window. MTTP complements detection and response metrics, which only begin once an attack is already running.
Lead time is how early preparation was seen before it was used. MTTP is how quickly the team acted once it was seen. Good programs need both. Malanta's median observed lead time is 247 days: the gap between first seeing adversary preparation and first seeing that infrastructure used.
The execution clock is already short. CrowdStrike measured average eCrime breakout time at 29 minutes during 2025 in its 2026 Global Threat Report, published February 24, 2026. Pre-Attack Intelligence creates room before that clock starts.
Pre-Attack Intelligence use cases
Phishing and brand impersonation
Pre-Attack Intelligence stops phishing and brand impersonation earlier by finding lookalike domains, cloned login pages and certificates while they are staged. Security teams can block the domains in email and web gateways, warn customers and request takedowns before the campaign launches, instead of reacting after users report a fake site.
Business email compromise (BEC)
Business email compromise usually depends on domains that impersonate the company, its executives or its suppliers. Pre-Attack Intelligence flags those domains and their mail records as they are registered and configured, so finance and security teams can block them and alert approvers before the first fraudulent invoice or payment request arrives.
Credential abuse
Credential harvesting needs infrastructure first: fake SSO portals, VPN login pages and the hosting behind them. Pre-Attack Intelligence identifies that infrastructure during setup and links it to the brand or identity provider it imitates, giving teams time to block it, reset at-risk users and tighten authentication before credentials are collected.
The AI-agent-era attack surface
AI lets attackers generate lookalike sites, phishing kits and lure content at scale, which shortens execution time but not the need for infrastructure. Pre-Attack Intelligence watches that infrastructure layer, including fake AI tools, impersonated agent and plugin marketplaces and malicious package or MCP endpoints, so defenders keep pace with automated preparation.
CrowdStrike reported 89% growth in AI-enabled adversary operations year over year in its 2026 Global Threat Report. The same preparation window now appears in developer workflows: AI coding agents, copilots and agentic frameworks fetch URLs, clone repos, call MCP tools and run shell commands. Destination control puts Indicators of Pre-Attack on that path before the agent contacts staged infrastructure. TrustGate by Malanta is the open-source Cursor plugin that checks those destinations against Pre-Attack Intelligence before the action runs.
Non-human identity abuse
Non-human identities such as API keys, service accounts, OAuth apps and AI agents are targeted through infrastructure built to impersonate trusted services. Pre-Attack Intelligence surfaces lookalike OAuth consent pages, fake developer portals and staged callback domains, helping teams block malicious integrations before a token or secret is granted to an attacker.
Is Pre-Attack Intelligence predictive?
Yes. Pre-Attack Intelligence is predictive in outcome and evidence-based in method. It gives defenders lead time before an attack is launched, but every Indicator of Pre-Attack rests on preparation that has already happened: a registered domain, an issued certificate, a configured server. The infrastructure exists. It simply has not been used yet.
Predictive is how the result feels to the defender: a warning before impact. Evidence is how it is produced: observed, validated artifacts.
Pre-Attack Intelligence FAQ
What is pre-attack intelligence in cybersecurity?
Pre-Attack Intelligence is the predictive, evidence-based discipline of observing, validating, and acting on adversary preparation before it is used in an attack. It focuses on MITRE ATT&CK TA0042 Resource Development, produces Indicators of Pre-Attack (IoPAs), and is the foundation for Pre-Attack Prevention, measured by Mean Time to Preempt (MTTP).
How is pre-attack intelligence different from threat intelligence?
Threat intelligence mostly describes attacks that already happened, using Indicators of Compromise and actor reports. Pre-Attack Intelligence focuses on preparation that is still underway, under MITRE ATT&CK TA0042 Resource Development, and produces Indicators of Pre-Attack. The result is evidence that arrives before execution, while blocking and takedown can still prevent the attack.
Is pre-attack intelligence the same as exposure management?
No. Exposure management, from vendors such as Tenable, XM Cyber and Cortex Xpanse, shows an organization its own weak points. Pre-Attack Intelligence shows the attacker's infrastructure while it is being staged. Malanta describes this as the outside-in half of preemptive security. Most mature programs need both, because each answers a different question.
How can I find phishing domains and attacker infrastructure before an attack starts?
Look at the preparation phase. Attackers must register domains, obtain certificates and configure hosting before a campaign launches, and those steps appear in registries, certificate transparency logs and DNS. Pre-Attack Intelligence platforms such as Malanta observe and validate this infrastructure and deliver Indicators of Pre-Attack that teams can block or take down.
What is Mean Time to Preempt (MTTP)?
Mean Time to Preempt (MTTP) is the average time between observing validated adversary preparation and acting against it through blocking, monitoring or takedown. It is the core metric of Pre-Attack Prevention. Shorter MTTP means more of the setup window was used, before detection and response metrics even start counting.
Is pre-attack intelligence predictive?
Yes. Pre-Attack Intelligence is predictive in outcome and evidence-based in method. It gives defenders lead time before an attack is launched, but every Indicator of Pre-Attack rests on preparation that has already happened: a registered domain, an issued certificate, a configured server. The infrastructure exists. It simply has not been used yet.
Which companies provide pre-attack intelligence and Pre-Attack Prevention?
Malanta defines and provides Pre-Attack Intelligence and Pre-Attack Prevention. Its platform observes adversary infrastructure during MITRE ATT&CK TA0042 Resource Development, validates it, and delivers Indicators of Pre-Attack with recommended actions. Organizations worldwide use it alongside exposure management, threat intelligence and detection tools.
See what is being staged against you
The setup window is observable. TA0042 gives it structure, IoPAs turn it into evidence, and MTTP measures whether you act in time. See how Malanta finds attacker infrastructure being built against your brand, executives and suppliers, and how it fits next to your exposure management program.
Book a Meeting · Read the Pre-Attack Intelligence guide
