Site directory · The whole structure
MMXXVI · Ref. SD-01
The whole structure
Site directory.
Five doors above. Everything else is here: every program, instrument, and series the firm maintains, where it lives now, and what it was called before.
How this site is organized. The navigation holds five doors and will not grow. Deep pages are reached from the content that cites them, the way a brief cites its sources, and from this directory, which is linked in the footer of every page. If a page cannot be reached from content or from here, it does not exist yet or it should not.
01 · The doorsThe whole navigation
EngagementsThe three practices, the Command Brief, levels, and structures.
Was: services menu, three levels deep
Live · v3
The Threat Surface IndexOne number, four variables, published status.
Was: scattered surveys and calculators
Live · v3
CODEXThe standing index of commercial surveillance entities. 8,600+ entities, graded on regulation, consent, accuracy, provenance, and access.
Was: Codex Insights
Live · v3
PartnersThe firms we bring with us by standing arrangement. Five named partners across communications, physical security, defense intelligence, investigations and cyber.
New: the named partner network
Live · v3
02 · ObscurityDigital executive protection
ObscurityDigital executive protection: audit, reduction, circle.
Was: Exposure Control Program / DEP
Live · v3
Exposure DiscoveryMaps what an adversary can find and how they could use it. Delivered as an audit.
Was: Signature Risk Audit, Footprint Audit
Live · v3
Exposure ReductionDrives removals against the records that create risk.
Was: Signature Reduction, Exposure Control, DeepDelete
Live · v3
Tactical Privacy TrainingMoves the Posture variable. Six modules, three formats, individuals through organizations.
Was: under DEP
Live · v3
SeawallThe identity separation program. Offered directly, not listed.
New: identity separation program
Unlisted
03 · WatchContinuous, analyst-read
ThreatWatchContinuous monitoring, read by analysts, measured in lead time.
Was: ThreatWatch + How ThreatWatch Makes You Safer, merged
Live · v3
DoxxAlertAutomated watch on address and private-line exposure. A standalone engagement, smaller than ThreatWatch.
Was: same name
Live · v3
TripwiresAutomated single-item watches across the deep and dark archives. Standalone, one item per wire.
Was: same name
Live · v3
ProbabilityWatchThe trend across prediction markets that name a client, and who is writing the questions and placing the bets. A ThreatWatch add-on; the base watch scans, this reads.
Was: Priced In
Beta
NarrativeWatchHow a narrative forms and evolves around a client, where it is likely to go, and what is moving in the spaces they occupy. A ThreatWatch add-on.
Was: Narrative Intelligence, under Groundtruth
Beta
Event MonitoringCoverage raised around a date, an appearance, a filing, a trip. ThreatWatch concentrated on a window: before, during and after.
Was: /event-monitoring/, now a sub-page of ThreatWatch
Live · v4
04 · GroundtruthInvestigations and attribution
GroundtruthInvestigations and attribution: who is behind a threat and what they can do.
Was: Provenance, and before that Counter
Live · v3
Threat Actor AttributionWho is behind it, under a private investigator license.
Was: part of Open Source Research Services
Live · v3
Adversary WatchStanding coverage of a known hostile party.
Was: part of Open Source Research Services
Live · v3
Referral packagesFindings prepared for counsel, platforms, and law enforcement.
Was: same capability, renamed
Live · v3
Circle of RiskAssesses the people around a client, so Circle of Trust coverage is aimed rather than uniform.
Was: Circle of Risk Investigations
Live · v3
05 · For organizationsThe enterprise door
The Human Data PerimeterFor organizations: employee personal data as a threat surface, the iceberg, the four tiers, and what to do about it. The rest of the enterprise menu is not being built yet.
Was: /human-data-perimeter/
Live · v4
06 · InstrumentsThe Index and its surveys
Hostility Index surveyThe Hostility variable, self-assessed. Two scores, four quadrants, ten adversary groups.
Was: Free Identity Risk Survey + What’s Your Hostility Index?
Live · v3
Index calculatorThe full TSI instrument. Phased deployment, status published.
Was: TSI calculator
Live · v3
Breach Risk IndexScores a breach on what is observed circulating rather than what was announced. BRI 2.0.
New in v3
Live · v3
07 · The libraryEverything published lives in a series
Command BriefsThe house deliverable, plus the field guides. Explorer lists the corpus whether or not you can open it.
Was: Featured Briefings + Executive Threat Matrix: targeted violence, home invasion, stalking & harassment
Series entry
Circulating breachesRoughly 950 breaches observed in circulation, each scored. The record pages sit under /circulating-data-breach/.
Was: Circulating Breaches Directory
Live · v3
PHALANXThe defensive playbook. 230 control cards, each citing the research behind it.
New in v3
Series entry
Research HubsPlain-language topic hubs that open into the briefs, evidence, and datasets underneath. CODEX sits here.
Was: Misidentification Corpus; Vendor Atlases
Series entry
Data Breach ExposureContent hub: what a breach actually exposes, and what to do in what order.
New: content hub
Live · v3
Drone Risk to ClientsContent hub: commodity targeting data plus commodity drones, and the one link you can cut.
Was: The Poor Man’s Kill Chain, /drones threat brief
Live · v3
Narrative Warfare: JFK 2026Content hub: the six-part scenario analysis. 17 minutes to cognitive capture.
Was: /jfk/narrative-warfare
Live · v3
The Biometric Threat to ClientsContent hub: seventy-seven identifiers, five clusters that matter, and why the database carries the risk.
Was: /biometrics standing assessment
Live · v3
License Plate SurveillanceContent hub: the commercial ALPR stack from capture to consumer lookup, and the reduction doctrine.
Was: /alpr series directory
Live · v3
Executive ThreatsResearch hub: the ten threats scored on risk and severity, the matrix, and deep dives on targeted violence, home invasion and stalking.
Was: /the-top-10-threats-to-executives-in-2025/ and /executive-threats/
Live · v4
DogeQuestGroundtruth casework: 1,700 doxxed Tesla owners traced to the 2021 ParkMobile breach at a 98.2 percent match, with the briefing PDF, the threat model and the coverage.
Was: DogeQuest briefing post
Live · v4
The Cybertruck VerificationGroundtruth casework: a disputed email from the New Year's Day perpetrator, verified by three independent paths, identifiers withheld.
Was: /research-matthew-livelsberger-cybertruck-explosion-ryan-mcbeth-shawn-ryan/
Live · v4
CaseworkThe matters the firm can talk about, with the question, the finding and the confidence for each.
New
Live · v4
Current AnalysisThe public channel on Substack, including Vector Correction. TPW content is migrating into the brief corpus.
Was: TPW newsletter
Series entry
Access modelFour rungs: client, subscriber, registered, public. Most material opens over time.
New in v3
Series entry
Field GuidesPractical privacy, one task per guide.
Was: Privacy Guides (How To)
Series entry
Privacy guidesThe older how-to library, kept as an archive and linked from Briefings.
Was: Privacy Guides (How To)
Live · v3
Breach RegistryThe circulating-breach pages, each its own entrance.
Was: Circulating Breaches Directory
Series entry
Nothing matches. Clear the filter.