Silent Push was founded in early 2020 to address a persistent weakness in cybersecurity, according to the CEO and co-founder, Ken Bagnall – many defenses respond only after a new attack campaign has already struck.
In an interview, he described a familiar cycle – attackers launch a campaign, security providers identify indicators of compromise, (IOCs), signatures and defenses are updated. But by the time those indicators are shared, the attackers may have moved on to different infrastructure.
“A number of companies have to be patient zero, each time,” Ken said, adding that this is only accelerating because threat actors now rotate through more infrastructure, faster.
What to look for
According to Ken, “So, it’s completely pointless (to share signatures), and everybody was stuck in this loop. It seemed that nobody could tackle the problem. So that’s why we started Silent Push; it was really to (address) that.”
And the company zeroed in on the conviction that they need to look earlier.
One component is domain names,
Essentially, it monitors patterns in how threat actors prepare internet infrastructure, including how they register, age the infrastructure and move domains across hosting providers. Ken said some attackers age domains for about a year to build a reputation that may make them appear more trustworthy to conventional security tools.
“Some APT (advanced persistent threat) groups always age their infrastructure by a year… during that year, they actually move it across different hosting providers in a rotation.”
To identify those patterns, Ken said it resolves DNS (domain name system) records daily and applies proprietary infrastructure “fingerprinting” and data analysis.
“(There’s) a lot of data collection on our end in order to be able to glue together the different signals… to show that it is a pattern of somebody managing their infrastructure in a certain way.”
Silent Push is developing what it calls a “context graph of the internet” – a collection of data and analytics about internet infrastructure changes over time – to support those defensive workflows.
(There’s) a lot of data collection on our end in order to be able to glue together the different signals… to show that it is a pattern of somebody managing their infrastructure in a certain way.
Ken Bagnall
For example, a traffic-origin service designed to help identify when an IP address that appears local may be associated with traffic routed from elsewhere through residential proxies.
The company’s central pitch, he said, is that understanding how adversaries prepare their infrastructure can give defenders more time to respond than waiting for an attack to reveal itself.
Research expertise
It can also help incident response teams investigate a suspicious hostname and find other infrastructure that may be managed in a similar way.
Silent Push positions its technology as a layer that integrates with customers’ existing security tools, such as SIEM platforms, firewalls, email security and web filtering.
“It’s technology IP. So it’s different layers of data science, like we have to collect the data in a certain way, then we have to roll it up in different ways,” Ken described adding that with a team of research leads who are ex US-government, Silent Push “has guys who are looking for new threat actors, new campaigns.”
Ultimately, it’s a combo of data science tech and expertise that investigates emerging threats and campaigns targeting particular industries.
Meaningful work and the APAC trajectory
Ken described the company’s work with public sector partners on cybercrime disruptions.
“We do a lot of work with the FBI, and that is more than just using the platform. We do large disruption campaigns to take down different crime groups.”
He said a collaboration the previous work with the FBI helped release more than 100 people who had been trafficked, and cited a separate effort involving police in Thailand and other organisations targeting scam centres.
Singapore is Silent Push’s base for the Asia Pacific region. “I think we’re very firmly embedded here, and then from here, I think you can have a lot of influence in the region.”
Sharing that artificial intelligence accelerates both cyber defense and cybercrime, Ken also observed a huge opportunity for Silent Push as “many of our customers have projects to provide their own agentic SOCs and have different agentic workflows as part of their security team (operations).”
The company’s growth in Asia Pacific alongside work with eight governments worldwide and public sector agencies reflects its ambition to give cyber defenders the time and intelligence to stay ahead as attack campaigns go live.
