Request a demo

Threat intelligence

Caught at one company.
Blocked at all.

Threat intelligence built into every Kodex product, not a feed you subscribe to.

Request a demoCheck how detection works
Threat signals
DetectAssessDisseminate
24/7Detection
4Signal sources
300+Block-listed emails
180+Countries risk-tiered
IDSignalSourceSeen atStatus
TI-30418Compromised police emailDark web3 companiesBlocked
TI-30416Spoofed agency domainDomain hygiene3 platformsIn review
TI-30411Sign-in anomalySign-in metadata1 companyIn review
TI-30407Behaviour anomalyUser base2 companiesSent
TI-30402Requester credentialVerificationNetworkVerified

The security and trust teams at the world’s largest crypto exchanges, banks, and telcos defend together on Kodex.

Trusted by

Outcomes

97.5%Fewer law enforcement ticketsCoinbase case study  →99.9%Faster law enforcement verificationBitget case study  →99%Of legal request issues resolvedBitfinex case study  →

Defending together

A single company can only
see what shows up
at its own door.

Defending alone means late.

Sophisticated threats aren’t visible from one vantage point. A compromised police email is used at multiple companies before detection. A spoofed agency domain hits three platforms before any sees it twice. Defending alone means defending late.

The Kodex Global Network connects 15,000 agencies and 150,000+ agents across 180+ countries. Every signal one customer detects benefits all. Fraudulent emergency data requests caught at one bank get caught everywhere.

That’s the difference between defending alone and defending together.

Kodex Global Network

15,000Agencies

150,000+Vetted agents

180+Countries

Fraudulent emergency data requestBlocked
Caught at
One bank
Caught
Everywhere on the network

01 · Detect

Detection runs on
every signal, every sign-⁠in,
every time.

The detection layer reads sign-in metadata, runs domain checks on credentials, monitors the dark web for compromised accounts, and watches for behavioral anomalies in the user base.

A single signal in isolation is noise. A signal correlated against 150,000 others is intelligence.

Detect24/7On

Process

  1. 01Checks sign-in metadata
  2. 02Runs domain check
  3. 03Monitors dark web
  4. 04Watches behaviour anomalies

Correlated against 150,000 others

02 · Assess

Detection produces
signals. Assessment turns
signals into judgments.

The Kodex Threat Intelligence team, who run Verification On Demand, continuously analyze network data.

Each country has a risk tier, from In Good Standing to Rejection Likely, based on real data. Threat actors are tracked across customers and time, linking patterns no single company could see.

The same domain spoofing used on three platforms, the same compromised credential surfacing in a new region: all connected here.

The judgment is the product. The signals are the input.

SignalUnknown requestSignalRequester anomaly
Assessing the riskIn review

Kodex team + Network

Country risk tier
Rejection Likely
Shares the threat signal to the networkSent

03 · Disseminate

The intelligence moves
in three directions.

CredentialPolice email accountBlocked
Active sessions re-verified
  • BankRe-verified
  • ExchangeRe-verified
  • TelcoRe-verified

Live propagation, network-⁠wide.

When a credential is compromised, every active session using it is re-verified across every customer, automatically. No alert to triage, no patch to apply. The network updates itself.

Threat alerts · Kodex Verify
Search emails and domains
  • Compromised email Blocked
  • Spoofed domain In review
Threat briefingMonthly reportSent

Threat alerts and threat briefings.

Threat alerts is a live feed of compromised emails and domains in Kodex Verify, searchable and integrated into your team’s workspace. Threat briefings is the monthly intelligence report: what the network saw last month and what’s coming next.

Kodex threat intelligenceNewsletterThreat actor named first
Cited in
Regulatory briefingsQuarterly reviews

Read across the industry.

The Kodex threat intelligence newsletter is read across the industry, cited in regulatory briefings and quarterly reviews, and often names threat actors first.

FAQ

Questions teams
ask before they
trust the network.

Request a demo
How is this different from a threat intelligence feed?

A threat feed sends you data and leaves you to figure out what to do with it. The Kodex layer is built into the products your team is already running. The same engine that verifies a requester is the engine that flagged the compromised credential they’re using. No feed to integrate, no parsing to do, no separate workflow. Detection happens where the work happens.

Can we get the threat intelligence without using the rest of Kodex?

The intelligence is the network, and the network is the customers using the platform. You can read the monthly Threat Briefing without being a customer. The live signal layer, the part that protects you in real time, only runs where the platform runs.

What’s the difference between Threat Alerts and Threat Briefings?

Threat Alerts is the live feed of compromised emails and domains inside Kodex Verify. Threat Briefings is the monthly narrative report from the Kodex Threat Intelligence team: what the network saw, what to watch next.

How quickly does a signal at one customer become protection at another?

Live. A credential flagged at one company on the network is re-verified against every active session touching that credential on every other company on the network. There is no “syncing window.”

Who is the Kodex Threat Intelligence team?

The same analysts who run Verification On Demand on behalf of customers. They built the network and they work its data continuously. Threat profiles, regional risk tiers, alerts, and briefings come from this team.

Threat intelligence

Not a feature.
A network, shared.

Every customer’s signals protect all the others. That’s how a network becomes a standard.

Request a demoSee how to integrate Kodex