Most threat intelligence tools stop at the alert. Overwatch's AI agents keep going, investigating cyber and fraud threats and connecting evidence across sources until your team has a decision it can act on.
Detected in monitored channels
Code interception is sold as a live service: a bot calls the customer, poses as the bank and captures the one-time code while the buyer is logged in.
# Duskwire OTP-CHAT1,214 msgs streams “live hits” that name Kestrelmoor among supported banks. # Ashwick Pay exchange860 msgs recruits “OTP work”: people who rent out bank accounts for a commission.
Manage and track your security investigations
9 investigations found
An OTP-interception bot lists Kestrelmoor among supported banks, and a recruiter in three channels pays commission for bank-account access. Six messages attached as evidence.
View DetailsA Telegram post sells a method for getting past Kestrelmoor’s new-device checks. Agents are matching it against recent account takeover reports.
View DetailsThree corporate logins for Kestrelmoor staff found in an infostealer log. Each one was matched to a current employee account and sent to the security team.
View DetailsA Telegram post offers payment to bank branch staff for customer lookups. Agents are tracking the poster across other channels.
View Detailskestrelmoor-verify.example served a copy of the online banking login page. The evidence package went to the brand team for takedown.
View DetailsA ransomware group posted data it says came from a payroll vendor Kestrelmoor uses. Agents are checking the sample for employee records.
View DetailsExposure review for five Kestrelmoor executives: home addresses on data broker sites, two impersonation accounts and public travel mentions.
View DetailsThirty-eight Kestrelmoor online banking logins posted to a paste site. Most pairs match an older breach; six are new.
View DetailsSocial posts offer cash to Kestrelmoor customers who rent out their accounts. Four posts trace back to the same recruiter.
View Details| Type | OTP-interception bot |
| Channel | Duskwire OTP-CHAT |
| Sender | Duskwire v4 |
| Banks named | Kestrelmoor Bank and 11 others |
| Claimed method | Automated call that asks for the code |
| Pricing | 1 week $60 · 1 month $150 |
| First Seen | 2026-10-04 |
| Messages | 1,214 |
| Source | Telegram |
Step-up checks on for new-device logins. SMS warning queued to customers.
Continuous collection across the criminal underground, markets, leak sites, forums and channels where fraudsters and threat actors stage. Classifiers and anomaly detection turn a constant stream of raw activity into candidate signal.
AI agents traverse threat actor networks, verify exploits, follow checkout flows, and assemble evidence packages, without waiting on an analyst to start.
Validated findings delivered into your stack: SIEM, SOAR, case management, executive briefings. Analysts answer the hard questions and find the leads the platform then watches for.
Used by Visa and 40+ other leaders in finance, fintech and media.
Platform
AI dropped the cost of running a scam to nearly zero, and threats arrive from every direction: compromised accounts, fraud patterns, fake merchant applications. Overwatch covers them all on one system, taking each from signal to decision. AI agents build the evidence, our analysts handle the cases that need human judgment, and your team acts in Overwatch or the tools you already use.
Human in the loop with expert support
Each case starts as a fragment, a receipt, a post, a record, and gets pulled until it resolves. The most challenging are investigated further by our analysts.
About 150 buyer receipts with no card numbers became an active attack on a national delivery platform's payout program: 6,439 cards listed on day one, 16,306 by day three. Platform notified in-window.
Stolen cards from several banks, all mailed to one state, became a possible insider at a third-party card manufacturer. Affected banks alerted.
A pinned post claiming an insider at a major bank became a documented allegation in the bank's hands before anyone else had seen it, marked as unvalidated.
One sample record from a marketplace claiming 170 million identities became a single identity-verification vendor, later confirmed by independent reporting and a federal inquiry.
When a fraud team makes a decision, real money moves. When a SOC escalates, hours of investigation follow. Overwatch is built to make sure that time isn't wasted, catching what your existing stack misses and turning it into a case worth escalating. This is operational threat intelligence: the shift from reactive triage to proactive, scalable risk operations.
When one bank’s fraud and cyber intelligence team switched to Overwatch, here’s what changed:
Results from one Overwatch customer’s first 90 days, compared with its previous tools and processes.
“Overwatch has surfaced more digital threats in 90 days than my entire 7 years at two previous major banks combined.”SVP, Fraud & Cyber Intelligence, Major Regional Bank
Frequently asked
AI-native threat intelligence and risk operations is a way of running fraud, cyber, brand and merchant risk reviews on one system, with AI agents and expert analysts doing the collection, investigation and first-pass assessment that teams used to do by hand. Overwatch Data built its AI threat intelligence platform on this model. What Overwatch learns about how attackers operate feeds straight into monitoring, investigations, onboarding reviews and risk decisions to combat digital threats.
Operational threat intelligence is threat intelligence that ends in action and can be pulled into everyday risk operations and reviews. Classic intelligence tiers use “operational” for insight into specific campaigns and actors. Overwatch uses the term more literally: intelligence that runs the investigation, reaches an assessment and lands in the workflow where a fraud, security or onboarding team makes its call. It reflects a wider shift in the market, as threat intelligence becomes risk operations infrastructure.
Overwatch goes further than threat intelligence. Most intelligence products deliver data and alerts, then leave the investigation and the decision to a human queue. Overwatch does that work. As an agentic threat intelligence platform, it collects adversarial intelligence from the criminal underground, uses AI agents and expert analysts to investigate it, and routes a defensible result into the systems where your team acts. Validated findings arrive with their evidence, a severity rating and a recommended action.
AI has pushed the cost of running an attack close to zero, while analyst headcount stays flat. With generative AI, the time needed to craft a convincing phishing email fell from about 16 hours to 5 minutes (IBM X-Force, 2023). Attack volume compounds and review capacity does not. Overwatch uses AI agents to run collection, triage and automated intelligence investigations, so a team’s capacity grows with the threat.
One platform matters because attackers already work across all three dimensions. A single threat actor can show up as a compromised account in the security queue, a fraud pattern in payments and a fake merchant application in onboarding. Teams in separate tools each see one piece, but leveraging digital forensics and threat intelligence can help show the network behind the threat. That is why Overwatch treats fraud threat intelligence and cyber threat intelligence as one discipline, collecting and prioritizing signals across cyber, fraud, brand and merchant risk on one system.
Overwatch builds AI agents for threat intelligence that do the investigative work an analyst would do, around the clock. Every investigation records the sources consulted and the evidence found, so the result can be traced and defended. Hard cases can be escalated to Overwatch analysts.
No. Overwatch takes on the manual collection and triage that consume most analyst time, so your team spends its hours on the decisions only people can make. Overwatch’s own analysts can validate complex cases and answer requests for information.
Yes, and its coverage goes wider than the dark web. Overwatch monitors deep and dark web forums and marketplaces, Telegram and other messaging channels used for fraud, ransomware leak sites, paste sites, newly registered domains, app stores and social platforms, including the non-English communities where much of the activity targeting enterprises begins. Monitoring is mapped to each customer’s brands, assets and domains, with compromised credential monitoring for its staff and customers. Overwatch’s dark web monitoring for financial institutions also tracks compromised cards and BINs.
Overwatch runs automated merchant due diligence with AI agents that review each merchant the way an experienced analyst would. They resolve the descriptor to a live site, inspect the storefront and policy pages, examine hosting and registration signals, trace the checkout and payment flow and check the criminal underground, then return a written verdict with risk indicators and evidence. Card networks, acquirers and payment facilitators use it for automated merchant onboarding, reviews, and ongoing merchant risk monitoring across thousands of merchants.
Overwatch is used by cyber threat intelligence, fraud and financial crime, brand protection, merchant risk, third-party risk and physical security teams. Customers include card networks, banks, fintechs, consumer platforms and media companies, among them Visa. The same intelligence engine is tuned for each team's domain.
Overwatch Data was founded by Arjun Bisen (CEO) and Zara Perumal (CTO). Arjun spent fifteen years in global risk at Stripe, Google and Twitter, including leading Stripe's fraud intelligence and onboarding risk team. Zara has spent more than a decade working on AI and cybersecurity, including as tech lead for Google's Threat Analysis Group.
Overwatch maintains a SOC 2 Type II audited security program covering access controls, encryption in transit and at rest, logging and monitoring, vendor review and employee training. Independent auditors review those controls every year. Prospects and customers can request the latest SOC 2 report, shared under NDA, through our contact form (choose Security).
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
AI threat intelligence platform
Overwatch collects adversarial intelligence from the criminal underground, investigates it with AI agents and expert analysts, and hands your team an assessment it can act on.
Compromised data and the methods being weaponized against your organization.
Dark web markets, ransomware leak sites and vulnerability chatter. Coverage spans the underground forums where key enterprise threats originate.
Automated merchant review and KYB, including fraud review and card network compliance checks.
Impersonation, lookalike domains and spoofed storefronts aimed at your brand, with takedown signals routed to the right team.
Threats against executives and VIPs that cross into the physical world, including risks tied to events and facilities.
Continuous monitoring for vendor and supply chain compromise, so a partner's exposure does not become yours.
Agents run the first pass of every investigation. Analysts take the hard cases. Your team works the result.
A compromised account flagged by security. A fraud pattern in the payments queue. A fake merchant application waiting in onboarding. Most tools see one of the three, because most tools were built for one team. Overwatch collects signals from across the threat landscape and connects them to the actor behind each.
How Overwatch works
Threat monitoring that's mapped to your priorities, and investigations that get to the bottom of what you're hunting for.
Detected in monitored channels
One seller, Tallowmark, is moving a batch of 14 full card numbers from a single Kestrelmoor BIN. The listing went up on a carding marketplace and is being promoted on Telegram.
Tallowmark posts the same batch in # Tallowmark Shop8 msgs, # Greywick Exchange5 msgs and # Wrenhollow Chat3 msgs, and points buyers to a private channel.
Manage and track your security investigations
9 investigations found
Fourteen full card numbers from one Kestrelmoor BIN on a carding marketplace. The seller also posts in three Telegram channels; six messages attached as evidence.
View DetailsA Telegram post sells a method for getting past Kestrelmoor’s new-device checks. Agents are matching it against recent account takeover reports.
View DetailsThree corporate logins for Kestrelmoor staff found in an infostealer log. Each one was matched to a current employee account and sent to the security team.
View DetailsA Telegram post offers payment to bank branch staff for customer lookups. Agents are tracking the poster across other channels.
View Detailskestrelmoor-verify.example served a copy of the online banking login page. The evidence package went to the brand team for takedown.
View DetailsA ransomware group posted data it says came from a payroll vendor Kestrelmoor uses. Agents are checking the sample for employee records.
View DetailsExposure review for five Kestrelmoor executives: home addresses on data broker sites, two impersonation accounts and public travel mentions.
View DetailsThirty-eight Kestrelmoor online banking logins posted to a paste site. Most pairs match an older breach; six are new.
View DetailsSocial posts offer cash to Kestrelmoor customers who rent out their accounts. Four posts trace back to the same recruiter.
View Details| Type | DEBIT |
| Bin | 52•••• |
| Last 4 | 4417 |
| Expiration | 08/2029 |
| Number | 52•• •••• •••• 4417 |
| CVV | ••• |
| Compromise Date | 2026-09-30 |
| Found In | Tallowmark Shop |
| Filename | fresh_14pcs[.]txt |
| Source | Telegram |
Blocked and reissued all 14 cards. Watching the seller for new batches.
Platform FAQs
No. Overwatch sits upstream of the systems your team already uses and delivers into them: SIEM, SOAR, case management, the Overwatch UI, API, email or webhook. Most customers keep their existing stack and use Overwatch to catch what it misses and to take manual collection and triage off their analysts.
Setup starts with mapping collection to your assets, vendors, brands and executives, and findings begin arriving once that mapping is in place. Most customers see first findings within the first week.
AI agents verify and enrich every signal before it reaches your queue, so what arrives is an investigated finding. Each finding is classified High, Medium or Low, which lets your team work the critical cases first, and Overwatch analysts validate the hard ones. Monitoring is tuned to your priorities, and each closed case sharpens what the platform watches for next.
Yes. Every investigation records the sources consulted and the evidence found, and every finding states what was confirmed and what was not, so the result can be traced and defended in front of an auditor, a regulator or your own leadership.
Yes. Overwatch analysts validate hard cases, write briefings and answer requests for information (RFIs), and customers can reach them directly. They work inside the forums, markets and channels where stolen data and access change hands, and every lead they run down becomes a detection the platform runs for all customers.
Yes. Overwatch optimizes the entire workflow, from data collection to detections and indicators, based on your feedback and findings from our analysts’ investigations.
Overwatch pricing depends on the capabilities in scope and the number of monitored assets, such as domains, brands, executives and merchants. Get a demo for a quote.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
Operational threat intelligence
AI broke the economics of attack. Scams now cost almost nothing to run and volume climbs every month, while the teams defending against them are still built to human scale. This is the case for rebuilding risk operations around intelligence that acts while a threat is still live.
Arjun Bisen, CEO and cofounderArjun Bisen, CEO and cofounderFor years, threat intelligence was limited to a specialized group of expert threat hunters, fraud investigators, and incident responders who used intelligence from the criminal underground and other external sources to anticipate emerging threats, strengthen defenses, or investigate incidents after they occurred.
Zara Perumal and I were part of that group. I led a risk team at Stripe, and Zara worked on countering influence operations at Google’s Threat Analysis Group. We had access to the underground, experienced investigators, and good tools, and we could still only investigate a fraction of what we saw.
But the barriers to entry for cybercrime and fraud have collapsed. Impersonating a business, compromising and selling accounts, launching phishing campaigns, and scaling malicious activity across thousands of digital touchpoints now takes little money and even less skill.
AI is speeding this up. In the underground forums we monitor, much of the “AI” on offer is marketing, but three uses are real and growing: sharper phishing and social engineering lures, automation platforms that let low-skill operators run campaigns at scale, and tools that sift stolen data for the most valuable targets. Attackers don’t need autonomous AI to do serious damage. They just need to do more, faster. AI gives them that.
The lines between cybersecurity, fraud, and financial crime are also blurring. The criminal groups we monitor don’t distinguish between these categories. They use whatever tools work, and share infrastructure across fraud, money laundering, and data harvesting, operating much like franchises, which is how the UN has described the scam networks running across Southeast Asia. The proceeds from these activities support broader criminal networks involved in trafficking, exploitation, and violence. Inside most enterprises, those threats still land on separate teams with separate tools, with security in one place, fraud in another, and third-party risk in a third. Attackers count on that.
That’s why threat intelligence now belongs in almost every enterprise risk workflow. Onboarding a merchant, vetting a vendor, monitoring a partner, spotting a new fraud pattern: each of these decisions gets better when you understand an entity’s digital footprint and can see the suspicious signals around it. The challenge is that few organizations have the investigative resources to apply this expertise at scale. Experienced investigators are scarce and expensive, and a single case can take days. Hiring more of them was never going to keep pace with attackers who can scale with a few lines of code.
What Zara and I learned from years on the defender’s side is that most of an investigation is routine work: gathering evidence, checking it against other sources, and ruling things out. Agents can do that work, and people should spend their time on the finer judgment calls only they can make.
This is why we built Overwatch Data.
By combining external intelligence, investigative tools, and AI agents, we can bring capabilities once reserved for specialist investigators into everyday risk operations. Teams can easily investigate threats, connect evidence across sources, and identify emerging risks without spending days on each case. Teams at Visa already use Overwatch. In its first 90 days, one customer resolved six times more critical threats, detected emerging threats three days earlier and got back more than 20 analyst hours each week. Every investigation also sharpens our agents, so the platform gets better for every customer the more it’s used.
The stakes go well beyond losses on a balance sheet. When fraud succeeds, the money often ends up funding trafficking and exploitation. That’s why we’re empowering threat intel, fraud and risk teams with the intelligence they need to act on threats before they cause harm.
Three shifts a risk team can make without ripping out the stack it already runs.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
Fraud and cyber threat intelligence research
Threat analysis and research on how attacks are run, from the team that watches criminal markets for a living.
Featured
AI broke the economics of attack. This is the case for rebuilding risk operations around intelligence that acts while a threat is still live.
Read more
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
About Overwatch Data
Arjun Bisen and Zara Perumal spent their careers inside the problem at Stripe, Google and Twitter. Overwatch is the system they wanted when they were the ones holding the line.
Why we built this
At Stripe, Google and Twitter, we worked on the teams that sit between attackers and the business. The job was always the same: find the signal, investigate it, decide. Every year the volume went up and the team stayed the same size.
Then attackers started using AI. A convincing phishing email went from a day's work to a few minutes. No amount of hiring keeps pace with that, so we set out to build a system that could.
Overwatch runs cyber, fraud, brand and merchant risk on one system. AI agents handle collection and the first pass of every investigation. Our analysts take the hard cases and teach the agents what to look for next. Every customer's detections make the platform sharper for the rest.
Fifteen years in global risk across Stripe, Google and Twitter, including leading Stripe's fraud intelligence and onboarding risk team. Began his career in the Australian Foreign Service, where he helped write the country's National Cyber Strategy.
More than a decade at the intersection of AI and cybersecurity. Worked on early agent systems at Google Assistant and served as tech lead for Google's Threat Analysis Group on influence operations.
Leads revenue and global go-to-market at Overwatch, with a focus on scaling growth and keeping customers for the long term. Previously held leadership roles at Cisco Systems, Symantec and IBM (BigFix), and at ThreatConnect, Flashpoint and Intel 471. Known for turning technical capabilities into clear business outcomes.
20 years of experience scaling teams and systems in search, machine learning, and data analysis. Recently managed Google teams engineering user safety and data protection across Google Search and Assistant.
Two decades of experience building and leading diverse, high-performing engineering organizations across infrastructure, reliability, and developer platforms. Most recently a Director at Google, leading Fitbit’s infrastructure organization after growing it from a small team into a multi-team group of engineers and managers, with a focus on developing leaders and delivering quality and velocity.
Logos, founder photos and boilerplate for press and analysts.
Download the press kit (ZIP, 0.6 MB)
Logo · White logo · Mark · Arjun · Zara · Boilerplate
Thirty minutes with someone who has done the job. Tell us where the volume is, and we'll show you what the agents find.
Not ready for a call? Start with a free threat assessment.
We point Overwatch at your domains, then send back what's already exposed, with sources.
What's already circulating, and where.
Impersonation, executive exposure and merchant portfolio signals are part of the full Overwatch platform; the free assessment doesn't include them.
What we need from you: your domains and, if you issue cards, your BINs. Nothing from inside your network.
What you get back: a written analyst summary of what was confirmed, what wasn't, and what we'd do first, plus an optional 30-minute readout.
How long it takes: 5 business days from the point we have the list.
What happens to your list: it stays confidential and is deleted after 90 days.
What it costs: nothing, and there's no obligation to talk to sales afterward.
Sample reportSee a sample assessmentA redacted Intelligence Risk Report. 2 pages, PDF.
Free threat assessment FAQs
The free dark web threat assessment shows what attackers already have on your organization. Overwatch points its collection at your domains, then reports what it finds: exposed credentials and compromised data. Impersonation, executive exposure and merchant portfolio signals are part of the full Overwatch platform, not the free assessment. Every item comes with its sources.
Your domains and, if you issue cards, your BINs. Nothing from inside your network and no software to install.
Results arrive 5 business days after Overwatch has your list. An analyst emails within one business day of your request to confirm scope.
Yes. There is no cost and no obligation to talk to sales afterward. You get a written analyst summary of what was confirmed, what was not and what to do first, plus an optional 30-minute readout.
It stays confidential. We delete the domains and BINs you submit 90 days after we receive them. We keep your name, work email and company so we can follow up, as described in our Privacy Policy, and you can ask us to delete those at any time through our contact form (choose Privacy).
Any organization can request one using a business email address. Overwatch reviews each request and confirms scope with the requester.
Choose a topic below and your message goes straight to the right team.
Engineering, analysis and go-to-market, building the system risk teams use to keep pace with attackers who automated first.
Working at Overwatch
Overwatch brings engineers, threat analysts and go-to-market people together on one product. Analysts work cases inside the forums and channels where attacks are planned, and every lead they run down becomes a detection the platform runs for every customer. The team is based in Brooklyn and Boston, with colleagues working remotely across the United States and abroad.
Careers FAQs
Overwatch is hiring across engineering, threat analysis and go-to-market. Current openings are listed above.
Overwatch is based in Brooklyn and Boston, with team members working remotely across the United States and abroad.
Candidates meet the hiring manager, the team they would join and a founder. Each role page lists its stages.
Threat analyst roles need fraud, cyber or intelligence experience. Engineering and go-to-market roles don't, though curiosity about how attackers work helps.
Overwatch Data, Inc.
This policy explains what personal information Overwatch Data, Inc. ("Overwatch," "we," "us") collects, how we use and share it, and the choices and rights you have. It applies to our websites, marketing communications, and the Overwatch platform.
This policy covers personal information we handle as a controller: visitors to overwatchdata.ai and related sites, people who contact us or request a demo, recipients of our communications, and users of the Overwatch platform. Where Overwatch processes data on behalf of a customer under a services agreement, that agreement and any data processing addendum govern, and this policy does not override them.
Information you provide. Name, business email, phone number, company, job title, and the content of messages you send us when you request a demo, contact us, subscribe to our content, register for an event, or apply for a role. Platform users also provide account credentials and configuration settings.
Information collected automatically. IP address, browser and device type, operating system, referring pages, pages viewed, time on site, and similar log data, collected through cookies and comparable technologies described below. The platform records authentication and activity logs for security and support.
Information from other sources. Business contact information from publicly available professional sources, event partners, and data providers, and information from resellers or partners who refer you to us. We may combine this with information you provide.
Threat assessment requests. If you request a free threat assessment, you may give us your organization's domains and card BINs. We use this information only to prepare the assessment and discuss it with you, and we delete it 90 days after we receive it.
We use personal information to provide, operate, secure, and support our websites and platform; respond to your requests; send service communications; send marketing communications you can opt out of at any time; analyze usage to improve our products; detect, prevent, and investigate fraud, abuse, and security incidents; comply with legal obligations; and enforce our terms.
Where the GDPR or UK GDPR applies, we rely on one or more of the following: performance of a contract with you or your organization; our legitimate interests in operating, securing, and marketing our business, provided those interests are not overridden by your rights; your consent, where we ask for it, which you may withdraw at any time; and compliance with legal obligations.
We do not sell personal information and we do not share it for cross-context behavioral advertising. We share personal information only with: service providers that process it on our behalf under contract, such as hosting, analytics, customer relationship management, email delivery, and support tooling; professional advisors such as auditors, insurers, and legal counsel; authorities where required by law, regulation, legal process, or to protect rights, safety, or property; and a successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this policy. We may share information with your consent or at your direction.
Our websites use only the cookies and similar storage they need to work. We don't use analytics or advertising cookies today. If we add them, we will ask for your consent first where the law requires it and update this policy. You can control cookies through your browser settings.
Where applicable law requires it, we treat a Global Privacy Control signal from your browser as a request to opt out of the sale or sharing of your personal information. We do not sell or share personal information as those terms are defined under California law.
We keep personal information for as long as needed for the purposes described here, including to comply with legal, accounting, and reporting obligations and to resolve disputes. Retention periods depend on the type of information and the context in which it was collected. Platform data is retained according to the customer's services agreement.
Overwatch maintains a security program audited under SOC 2 Type II, including access controls, encryption in transit and at rest, logging and monitoring, vendor review, and employee training. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Overwatch is based in the United States and may process information there and in other countries where we or our service providers operate. Where we transfer personal information from the EEA, we use the European Commission's Standard Contractual Clauses; from the UK, the UK International Data Transfer Addendum to those clauses; and from Switzerland, those clauses as adapted for Swiss law.
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a portable copy, restrict or object to certain processing, and withdraw consent. You may opt out of marketing email using the unsubscribe link in any message or by contacting us.
If you are a California resident, the CCPA/CPRA gives you rights to know, delete, correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law. We will not discriminate against you for exercising your rights. You may designate an authorized agent to make requests on your behalf.
To exercise any right, contact us through our contact form (choose Privacy). We will verify your identity before responding. If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.
Overwatch provides threat intelligence services. In delivering them, the platform collects and analyzes information from publicly available sources and from online spaces Overwatch can lawfully access, including criminal forums, marketplaces and messaging channels, some of which require an invitation. That information may incidentally include personal data about third parties who are not our customers or users. We process it for the purpose of detecting and preventing fraud, cybercrime, and related harms, on behalf of and at the direction of our customers, and in accordance with applicable law. We apply access controls and retention limits to this data and do not use it for marketing. Questions about this processing may be directed to the contact below.
Our websites and platform are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
Our sites may link to third-party websites and services. This policy does not apply to them, and we are not responsible for their practices.
We may update this policy from time to time. We will post the revised version here with an updated date and, where changes are material, provide additional notice such as email or a notice on the site.
Overwatch Data, Inc.
123 7th Ave, Unit 2, Brooklyn, NY 11215, United States
Questions, requests, or concerns about this policy:
Use our contact form and choose Privacy.
Overwatch Data, Inc.
These terms govern your use of overwatchdata.ai and related Overwatch websites (the "Site"). Access to the Overwatch platform is governed by a separate services agreement between Overwatch and your organization.
By accessing or using the Site you agree to these Terms of Use and to our Privacy Policy. If you do not agree, do not use the Site. If you use the Site on behalf of an organization, you represent that you have authority to bind it.
The Site is intended for business and professional use by persons 18 or older. You may use the Site for lawful purposes and in accordance with these terms. We may suspend or terminate access at any time for conduct we believe violates these terms or is harmful to Overwatch, other users, or third parties.
The Site and its content, including text, graphics, logos, images, software, and the Overwatch name and marks, are owned by Overwatch Data, Inc. or its licensors and are protected by copyright, trademark, and other laws. Except as expressly permitted, you may not copy, modify, distribute, republish, or create derivative works from Site content without our prior written consent. Third-party names and logos appearing on the Site belong to their respective owners and are used to identify their products or services.
You agree not to: access the Site by automated means, including scraping, crawling, or harvesting, except as permitted by our robots.txt; attempt to probe, scan, or test the vulnerability of the Site or circumvent any security or access controls; interfere with the Site's operation or impose an unreasonable load on its infrastructure; impersonate any person or misrepresent your affiliation; submit false or misleading information through our forms; or use the Site to transmit malware or unlawful content.
Access to the Overwatch platform, including any trial or demonstration environment, is provided under a separate written agreement between Overwatch and the customer organization. That agreement governs use of the platform and any data or intelligence delivered through it. Nothing on the Site grants a license to the platform. The free threat assessment offered on the Site is governed by the Free Threat Assessment Terms below.
These terms apply when you request a free threat assessment from Overwatch Data, Inc. ("Overwatch") through our website. By checking the box on the request form, you agree to them on behalf of the organization you name.
Content on the Site, including statistics, case examples, and product descriptions, is provided for general informational purposes. Product features and figures may change without notice. Illustrative data shown in interface mockups and feed panels is representative and does not depict any specific customer or incident. Nothing on the Site constitutes legal, security, or professional advice.
The Site may link to third-party websites. We do not control them and are not responsible for their content, policies, or practices. Links do not imply endorsement.
THE SITE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, OR UNINTERRUPTED OPERATION. OVERWATCH DOES NOT WARRANT THAT THE SITE WILL BE ERROR-FREE OR FREE OF HARMFUL COMPONENTS.
TO THE FULLEST EXTENT PERMITTED BY LAW, OVERWATCH AND ITS OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, DATA, OR GOODWILL, ARISING FROM YOUR USE OF THE SITE. OVERWATCH'S TOTAL LIABILITY FOR ANY CLAIM RELATING TO THE SITE WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US$100). SOME JURISDICTIONS DO NOT ALLOW CERTAIN LIMITATIONS; IN THOSE JURISDICTIONS OUR LIABILITY IS LIMITED TO THE EXTENT PERMITTED BY LAW.
You agree to defend, indemnify, and hold harmless Overwatch and its affiliates from claims, damages, and expenses, including reasonable attorneys' fees, arising from your violation of these terms or your misuse of the Site.
These terms are governed by the laws of the State of Delaware, without regard to conflict-of-law rules. Any dispute arising from these terms or the Site will be brought exclusively in the state or federal courts located in New Castle County, Delaware, and you consent to their jurisdiction. If any provision is found unenforceable, the remainder will continue in effect. These terms, together with the Privacy Policy, are the entire agreement between you and Overwatch regarding the Site.
We may revise these terms at any time by posting the updated version here with a new date. Continued use of the Site after changes are posted constitutes acceptance.
Overwatch Data, Inc.
123 7th Ave, Unit 2, Brooklyn, NY 11215, United States
Questions about these terms:
Use our contact form.
Investigations
AI agents take each signal from first sighting to evidence package, Overwatch analysts take the cases that need judgment, and your team works the result in the platform or in the tools it already uses.
Investigations
Most intelligence products stop at the alert and leave the investigation to your queue. Overwatch starts it. Agents follow the actor, resolve connected infrastructure, pair exposed data with breach records and check what has been seen before. Analysts take what needs judgment. Every finding states what was confirmed and what was not, so the result can be defended in front of an auditor, a regulator or your own leadership.
AI agents traverse threat actor networks, verify exploits, follow checkout flows and assemble evidence packages, without waiting on an analyst to start.
Overwatch analysts work the hard cases by hand, including leads found through human collection where stolen data and access are sold.
Ask about an actor, a campaign or an exposure, and an analyst runs it down and writes it up.
Assign findings to individuals, set and update status, comment and collaborate on each case from first signal to close.
Sources consulted, evidence found, connected entities and a verdict, attached to every finding.
Email and SMS alerts, Slack, API, and SIEM and case management integrations.
How it works
A finding surfaces from collection: a post, a listing, a leaked record, a newly registered domain.
Agents follow the actor, resolve infrastructure, pair data with breach records and check history. Analysts take what needs judgment and validate the result.
The case arrives with its evidence, a verdict and a recommended action, assigned to the right owner in the platform or routed into your stack.
Frequently asked
A finding with the sources consulted, the evidence found, the connected entities, what was confirmed and what was not, and a recommended action.
Yes. Findings can be assigned to individuals, given a status, updated, commented on and worked together in the platform. They can also be delivered by email or SMS, in Slack, through the API, or into your SIEM and case management tools.
Yes. Send a request for information about an actor, a campaign or an exposure, and an Overwatch analyst runs it down and writes up the answer.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
What's moving in the criminal underground, and what it means for fraud, cyber and merchant risk teams. Written by Arjun and Zara.
What Cyber Pulse is
Cyber Pulse is the briefing we write for ourselves and then send out. It covers what changed in the threat landscape, what we're seeing in fraud and cyber channels, and what it means for the teams on the other side of it. Product news, when there is any, stays to a short note at the end.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
Our Co-Founder & CTO Zara Perumal reflects on her recent speaking tour across community banking and cybersecurity conferences, sharing observations about how different communities approach AI. From those who see it as creative opportunity to those who view it as risk, she argues all perspectives hold value and must be balanced. Drawing on insights from PruVen Capital about the shift from "software as a service" to "services as software," Zara explains how Overwatch Data was built on the principle that AI should be a bicycle for the mind: scaling monotonous work to enable more community connection, better customer care, and greater impact on society's toughest problems.
Zara Perumal, CTO and cofounder
The last few weeks have been a blur! From NYC with the FinCyber Femmes to Kansas City with the Community Bankers of Illinois, up to the Dells with the Community Bankers of Wisconsin, then back to Boston for BSides Cambridge! What I really loved was each community was so genuine and dedicated to making an impact. In some cases with community bankers who work tirelessly to provide a mix of innovation and personal touch to make sure their customers know they can always be counted on to be there and pick up the phone. Then to cyber communities who are focused on ways to stop the harm done by evolving scams and cybercrime. I personally loved how in each of these places, the communities were focused on impact and collaboration vs posturing.
What's been interesting to me is seeing how AI can mean so many things to so many different people. Some people see AI as fun, or an opportunity to be creative and be more imaginative than ever before. Some people see it as the risk to their business with the non-malicious insiders who may download malicious AI software, or upload sensitive data. Others see it as an opportunity to take the monotonous chores off their plate "...using AI to wash their dishes, not write their poetry." Others fear transformation as we see how much the world is changing. Others see how it can be used to enable crime directly, ushering in a new era of crime!
I think all are true and perspectives we should take in balance! AI ushers in a new era of opportunity and risk, but I think being familiar with it and understanding what it can do and how it can be fun gives an incredible advantage. I feel like you can read as much theory as you want, but it's so hard to get the intuition without using it! We're in an era where AI's progress surprises those who built it, and a practical tangible understanding of what it can do today is incredibly helpful to understand its possibilities and failure modes.
A few weeks ago, Sudip, one of our investors at PruVen Capital, posted an article about how we see a move towards services as software vs software as a service. This has been top of mind for me the last few weeks and is core to how we built Overwatch Data! To me, if we do it right, AI is a bicycle for the mind. It scales our work on the things we dislike, and enables us to be more creative and try more ideas! But fundamentally, it is used as a way to enable and empower incredible humans, enabling more of the community feel, more care for our customers, more impact on society's toughest problems! Like I've felt the last few weeks across these incredible communities.
More than a decade at the intersection of AI and cybersecurity, including early agent systems at Google.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
Analysis of AI's evolution from cybercrime assistant to primary operator through three case studies: autonomous data extortion campaigns, fraudulent North Korean IT employment, and AI-generated ransomware sales. We show how AI eliminates skill barriers, enabling sophisticated attacks by non-technical actors at machine speed.
Following Overwatch Data co-founder Zara Perumal's congressional testimony and Anthropic's latest threat report, a troubling reality is emerging: cybercriminals are now completely dependent on AI to execute sophisticated attacks they couldn't pull off alone.
When Zara testified before Congress in July that AI is making cybercrime "more accessible, more personalized, and more difficult to detect," Anthropic's August report provided the receipts. Their threat intelligence team documented multiple cases where Claude AI became the operational brain of criminal enterprises.
This isn't about smarter phishing emails anymore. We're watching AI systems make strategic criminal decisions on their own.
Anthropic's most striking case involved a cybercriminal who used Claude Code to hit 17 organizations in a single month: hospitals, government agencies, emergency services. But here's what's different: the AI wasn't just helping with tasks, it was running the show.
Claude decided which data to steal, calculated ransom amounts by analyzing stolen financial records, and crafted psychologically targeted extortion demands. It created detailed "profit plans" with multiple monetization strategies, sometimes demanding over $500,000. The AI analyzed organizational budgets and donor databases to maximize pressure on victims.
What we still don't know is how the attacker got into these networks in the first place, suggesting traditional vulnerabilities may still be the entry point.
The North Korean IT worker schemes show how AI eliminates the need for actual technical skills. Operators who couldn't write basic code independently were successfully working at Fortune 500 companies, using Claude for most of their development work.
These people passed technical interviews and delivered working code while being completely dependent on AI. They couldn't even communicate professionally in English without assistance. Yet they're earning salaries that help fund weapons programs, generating hundreds of millions annually according to the FBI.
A UK-based criminal used Claude to develop and sell ransomware variants with advanced features for $400–$1,200 on dark web forums. The catch? They couldn't implement basic encryption or understand Windows internals without AI help.
Within hours of Claude generating the code, it showed up on VirusTotal with submissions from multiple countries, indicating active deployment. AI has essentially democratized sophisticated malware development.
These cases show AI moving from helper tool to primary operator. Cybercrime used to require real technical skills that naturally limited who could pull off complex attacks. AI removed that barrier entirely.
As Zara warned Congress about "agentic AI" systems that act autonomously and learn by doing, Anthropic's report shows this evolution is already happening in criminal operations.
When AI can adapt to security measures in real time and make strategic attack decisions, our traditional playbook becomes inadequate. Both reports stress that fighting AI-powered crime requires AI-powered defense.
As Zara put it: "scaled offense necessitates scaled defense." But the documented cases also highlight how much we still don't understand about these new attack patterns.
These cases likely represent the first wave, not the peak, of AI-enabled cybercrime. The combination of disappearing skill barriers and advancing AI capabilities means we're entering uncharted territory where sophisticated attacks no longer require sophisticated attackers.
For defenders, the takeaway is clear: the old assumption that complex attacks need skilled criminals is dead. We're now facing AI-powered operations that move at machine speed with strategic intelligence that was once limited to elite threat actors.
The question isn't whether AI will keep transforming cybercrime, it's whether our defenses can evolve fast enough to keep up.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
In this episode of the Cult Products Podcast, host Phill Keaney-Bolland speaks with Arjun Bisen, Co-Founder and CEO of Overwatch Data, about building AI agents for cyber and fraud threat intelligence. Arjun traces the path from diplomacy and global security through Google and Stripe to founding Overwatch, sharing the early insight that sparked the company, how Y Combinator provided both funding and enterprise credibility, and why proof of value matters more than polished messaging in security markets. The conversation also covers how Overwatch thinks about product roadmaps in a fast-moving AI landscape, what product-market fit actually looks like for enterprise startups, and the psychological and human realities of building a company over the long haul.
Arjun Bisen, Co-Founder and CEO of Overwatch Data, sits down with Phill Keaney-Bolland on the Cult Products Podcast to talk about the origin of Overwatch, what it takes to earn enterprise trust, and the human realities of building a company for the long haul.
Every founder looks for the moment when the work finally clicks. For Arjun Bisen, that moment had a name: BERT.
"That was one of those moments for me," Arjun recalls. "BERT was a tiny model compared to GPT. But that's really when I was like, 'Okay, if we had an army of Google Assistants with BERT, we could do a lot of amazing cybersecurity automation.'"
It wasn't a random insight. It came from years spent watching how risk and intelligence work actually gets done inside government, Google, and Stripe, and seeing up close how manual and fragmented those systems still were. Security teams buried in noise. Fraud analysts working from stale data. A market full of vendors making promises they couldn't keep. Overwatch was built to change that: AI agents that monitor cyber and fraud threats at the speed attackers operate, not the speed analysts can keep up with.
Arjun's path to founding Overwatch isn't a typical Silicon Valley story. Before Stripe and Google, he worked in diplomacy and global security, a background that turned out to be formative for building a threat intelligence company. That experience shaped how Overwatch thinks about risk: not as a compliance exercise, but as something that lives in adversarial, constantly shifting environments where the rules change faster than most organizations can track.
It also shaped how Arjun thinks about sales. Regulated markets and enterprise security buyers don't care about polished decks. They want proof. "There were certain types of customers that were inclined to pick the dream instead of the status quo," he says, "and as a startup you kind of have to know which ones are that and lean into them."
For Arjun, Y Combinator wasn't just a check. It was the reason Overwatch got off the ground at all.
"I wouldn't have founded a startup had it not been for YC. So I'm definitely one of those people that YC gave me the vehicle through which to embark on this journey through multiple fronts."
In enterprise security, credibility is currency. The YC stamp opened doors that would otherwise have taken years to crack and made recruiting possible before the company had much else to show. "You can spend years just trying to find someone to believe in your idea and fundraise. And so with YC, you get a check out of the gate and you get the logo, and it means you can recruit people and start actually building."
Cybersecurity has a trust problem. Vendors overpromise, buyers get burned, and every new sales conversation starts with skepticism already baked in. Overwatch's answer was to go the other direction: lead with proof of value, find the use cases that repeat, and show the work before asking for anything in return.
It sounds simple, but in a market where everyone claims to be AI-native and fully autonomous, honesty turns out to be a real differentiator. The customers worth winning, Arjun found, are the ones willing to build with you rather than just evaluate you.
Some of the most valuable parts of the conversation have nothing to do with product or go-to-market strategy. Arjun is unusually candid about what the journey actually feels like from the inside.
"The ratio flips from maybe ten percent of your requests being declined to ninety-nine percent of your requests being declined, and that psychological impact is probably what kills a lot of founders rather than the process."
Staying alive, not just keeping the company alive, turns out to be one of the core disciplines of early-stage building. "A lot of this journey is staying alive on all fronts, like your personal life, your staff, your co-founders, and the people you love."
And then there's community. Not the performative kind, but the kind built through years of showing up and giving before you need anything back. "You need a community, and a community isn't all one way. You have to give a lot to have a community."
If Arjun could tell his earlier self one thing, it would be this: "Be more patient and discerning with who you work with, because this is a very long journey."
Listen on Apple Podcasts or Spotify, or watch the full conversation on YouTube.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
An overview of emerging fraud taxonomy frameworks and how they compare to established cybersecurity standards. This post examines the Fed's FraudClassifier and ScamClassifier, Stripe's FT3 framework, and FS-ISAC's coordination model, explaining what each solves, how they complement each other, and why no single taxonomy is enough. Learn how leading organizations are combining these frameworks to break down silos and operationalize fraud intelligence more effectively.
Arjun Bisen, CEO and cofounder
I've been in many conversations with cyber, intel, and fraud experts where they've praised taxonomies like the MITRE ATT&CK framework and sharing of Indicators of Compromise (IOCs) that are commonly understood in cyber intelligence and wished that the fraud taxonomy was as well developed. That would allow them to throw all the fraud accounts/IOCs into a centralized system to take automated action/scoring.
That said, there are some very useful fraud taxonomies that are being worked on by some of the best in the business, which could have a big impact on how we organize. Each of the major frameworks focuses on solving a different problem.
The Fed's FraudClassifier has become a foundational standard for banks and payment providers. Its strength is simplicity: a clear, payment-agnostic way to distinguish authorized vs. unauthorized fraud and report losses consistently across the industry.
The Fed's ScamClassifier builds on this by addressing a major blind spot, authorized scams. By breaking scams into concrete types (romance, investment, impersonation, etc.), it added much-needed clarity to an area that was previously vague, on the rise, and inconsistently labeled. The Fed has a useful guide on how to leverage this classifier.
The most tactical of all, the FT3 framework, built by Vincent Passaro and the good people at Stripe, takes a very different approach. Modeled after cybersecurity frameworks like MITRE ATT&CK, it classifies fraud by the tactics and techniques used by attackers. This is powerful for detection and threat intelligence, but also more complex to operationalize. However, as a technology company, we've found useful ways to leverage their GitHub repo to automate the classification of fraud materials, leveraging our AI agents. We're always happy to share our approach with anyone interested.
Finally, FS-ISAC's Cyber Fraud Prevention Framework focuses less on classification and more on coordination. By mapping fraud across stages, from reconnaissance to monetization, it helps break down silos between fraud, cyber, and AML teams. It's especially useful in organizing info sharing via FS-ISAC's platform.
The takeaway: there's no single "best" taxonomy. The strongest fraud programs combine:
How are you all using these taxonomies today? What did I miss?
I generally feel like the data we need to tackle fraud exists but often sits in silos, is unstructured, and could really benefit from tighter classification that would allow it to be operationalized in a simple way.
Fifteen years in global risk at Stripe, Google and Twitter, including leading Stripe's fraud intelligence and onboarding risk team.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
Arjun Bisen analyzes emerging fraud trends heading into 2026 based on cybercriminal playbooks already circulating online. Key shifts include fraud operations moving from the dark web to mainstream social media platforms, AI agents transitioning from content generation to operational crime automation, and identity infrastructure becoming the primary attack target. Despite increased enforcement efforts through major Interpol-led crackdowns, systemic prevention remains the critical gap. The post highlights the most discussed CVEs and ransomware groups, emphasizing that defense requires coordinated action as cybercrime continues to evolve and scale.
Arjun Bisen, CEO and cofounder
Spotted in the wild: the first "2026 fraud guides." Yes, cybercriminals are already publishing their playbooks for next year, so here's our defender-side summary of what we expect in 2026.
1. Fraud moves fully into social media. We're seeing a clear shift from the deep/dark web to Instagram, WhatsApp, Discord, X, and Telegram. Even more concerning: Meta Ads and Google Ads are being used for tricking users into clicking spoofed sites and precise targeting (e.g. mule recruitment, scam funnels). Social platforms are now core fraud infrastructure, not just distribution channels. (Why this matters)
2. AI-powered crime gets operational. 2025 was about GenAI content. 2026 will be about AI agents. Browser and "computer use" agents can now:
We're also seeing:
3. What's not changing? Check fraud (especially in the U.S.). Despite declining check usage, losses keep growing due to:
Mail theft, check washing, and synthetic identity cash-out networks are still thriving.
4. Enforcement is improving, but not keeping up. 2025 saw major Interpol-led crackdowns (hundreds of arrests, thousands of scam assets disrupted). But these cases highlight a hard truth: enforcement alone doesn't scale without systemic prevention.
5. CVEs that will matter most in 2026. Not the flashiest ones, the most monetizable ones:
Identity is now the primary security target. Prediction: any auth-bypass CVE in a top-5 identity platform will be exploited in days, not weeks, in 2026.
Fighting cybercrime is a team sport, and defense wins with coordination. Excited to continue being a key partner to you all in 2026.
Fifteen years in global risk at Stripe, Google and Twitter, including leading Stripe's fraud intelligence and onboarding risk team.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
Fraud has evolved from dark web forums to mainstream social media platforms, where scams like the Chase glitch and Klarna money glitch can go viral in hours. Legacy threat intelligence tools can't keep pace with fraud that spreads at social speed. This post explains why real-time monitoring of social platforms is now essential for fraud teams, and how new approaches to viral fraud tracking can help organizations detect and respond to emerging threats before they go mainstream.
Arjun Bisen, CEO and cofounder
Fraud has expanded from the deep and dark web to mainstream social media platforms and forums, to devastating effect.
Remember the Chase glitch, Klarna money glitch, etc.?
Legacy threat intel tools weren't built for this. And waiting weeks or months for coverage in trusted publications (like Frank on Fraud) isn't always an option.
That's why we launched a new module at Overwatch, designed to track viral fraud trends in real time, as they emerge and spread.
Stay ahead of the next wave with:
Fifteen years in global risk at Stripe, Google and Twitter, including leading Stripe's fraud intelligence and onboarding risk team.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
Our CTO Zara Perumal reflects on her recent travels to Google's AI Founders Summit and CBA of Georgia's CONNECT conference. From Silicon Valley's tech innovation to Amelia Island's community banking discussions, she explores the surprising parallels between threat intelligence and community banking, both rooted in daily risk assessment and strengthened by collaboration. Her insights reveal how AI integration doesn't have to be overwhelming: it can work alongside humans to handle repetitive tasks while preserving what makes communities truly human.
Zara Perumal, CTO and cofounder
The Google AI Founder summit was so energizing! In discussing with founders and Google researchers and product builders, we discussed the future of agentic products, the power of fun and creativity in exploration and in this revolutionary time building towards the future we want. Driving around in driverless Waymos, it was an incredible juxtaposition of imagining the AI-fueled future, surrounded by such an incredible caring, genuine and inspirational community that felt so human!
The CONNECT conference in Amelia Island was a lot of fun! In a beautiful destination I got to talk to some incredible people. We discussed how check fraud is impacting banks, and how AI is fueling social engineering. And how to think about integrating AI with guardrails. It doesn't have to be everywhere all at once! It can be integrated with humans in the loop, and be deployed on the repeated monotonous work to free up time for the tasks that you love to do.
I'm struck by the similarities between community banking and threat intelligence: both are rooted in thinking about risk every day, and both thrive on the strength of community. From founding a company to working in threat intelligence, I've seen how much collaboration and shared lessons matter. Being a guest here, it was inspiring to see how strong and supportive this community is.
The closing talk by Don Yaeger highlighted what makes great athletes exceptional, emphasizing the importance of surrounding yourself with great people and teammates, a lesson that resonates far beyond sports.
Next up: Zara heads to NYC for FinCyber Femmes on Monday, September 16.
More than a decade at the intersection of AI and cybersecurity, including early agent systems at Google.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.
Advances in AI are empowering criminals to commit sophisticated fraud through hyper-realistic fake IDs, adaptable phishing bots, and personalized social engineering scams. To stay ahead of these high-tech threats, businesses and individuals need increased awareness and defensive AI tools.
The rapid evolution of Artificial Intelligence (AI) has ushered in an era of unprecedented innovation and possibilities. However, this technological marvel doesn't discriminate between noble and malicious intent. Today, the criminal underworld is rapidly harnessing AI to refine, accelerate, and diversify its fraud techniques.
At the forefront of this AI-driven fraud wave are check and ID scams:
But perhaps the most alarming development is in the realm of social engineering:
In navigating this intricate maze of fraud risks, companies need a partner who not only understands the cyber landscape but also the intricacies of human-driven threats. This is where Overwatch stands out.
Leveraging an AI-driven fraud intelligence platform, Overwatch dives deep into a myriad of data sources. From the shadowy corners of the deep web to the bustling activity of the surface and social web, Overwatch's system is constantly on the prowl.
But what truly sets Overwatch apart is its ability to categorize these threats meticulously. It's not just about knowing a threat exists; it's about understanding its nature. For instance, distinguishing between "methods targeting you" and "offers for stolen accounts" can be the difference between proactive defense and crisis management watch demo.
Best of all, you can easily identify spikes and trends over time, and compare your exposure relative to peers demo. Moreover, Overwatch's in-house investigation capabilities offer an added layer of scrutiny. With this dual approach, companies can stay updated on the latest methodologies being peddled by fraudsters, ensuring they remain a step ahead.
The fusion of AI and fraud signifies a paradigm shift in the threat landscape. While we celebrate the benefits of AI, it's crucial for individuals, businesses, and institutions to recognize and adapt to these emerging threats. The battle isn't just against human fraudsters anymore; it's against their increasingly intelligent digital accomplices.
As AI's capabilities grow, the line between genuine and fraudulent will blur. Preparing for this challenge requires a combination of awareness, education, and leveraging AI's power for defensive strategies, ensuring we remain one step ahead of the malicious innovators.
What changed in the threat landscape, what risk teams should watch, and one operational takeaway. Written by Arjun and Zara.
Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.