Analyst Credits & Training
SpyCloud’s expert analysts are available on an as-needed basis to support your team with investigations, threat intelligence analysis, and targeted training. No Investigations license required to access this service.
💡 What Are Analyst Credits?
SpyCloud Analyst Credits give you access to our expert analysts to perform in-depth investigations and research on your behalf.
- 🔢 Sold in bundles of 25 credits
- ⏳ Valid for 1 year from purchase
- ⚖️ Minimum of 1 credit per request
- 🧮 Does not consume SpyCloud query count
- 🕒 Available Monday–Friday, 8:00 AM – 6:00 PM CT
🛠️ How It Works
| Step | Timeline |
|---|---|
| RFA Received | Submitted via portal or email |
| Acknowledgement | Within 1 business hour |
| Analyst Assigned | Within 1 business day |
| Results Delivered | Secure delivery upon completion |
📬 Submit your RFA by emailing:
[email protected]
🧾 What’s Included
SpyCloud Analysts can support:
- 🔍 Formal analysis based on indicators
- 👥 Peer review of your team’s findings
- 🧠 Custom training and briefings
- 🕵️ Identity correlation, credential reuse, malware victim profiling
🎯 Common Selectors
Your RFA can include:
- Emails, phone numbers, domains
- Hashed or plaintext passwords
- Malware-infected machine IDs
- SSNs or IDs (hashed)
- Social media handles
➕ 200+ additional supported selectors
💳 Credit Usage Guidelines
- 🔹 Minimum: 1 credit per request
- ⏱️ If >1 hour of work is required, you’ll receive an estimate before work begins
- 📌 Credits are consumed in full (no partial credits)
🧠 Analyst Services Examples
| Activity | Description | Est. Credits |
|---|---|---|
| Email or Password Initial Analysis | Simple attribute pull for ≤50 indicators | 1 |
| Identity Correlation / Actor Attribution | Identify all accounts linked to email or phone | 3 |
| Actor Profiling | Build a full actor profile from indicators | 7 |
| Infected Device & User Identification | Map users to known botnet or malware infections | 5 |
| Credential Stuffing Origin Analysis | Tie stuffing attack samples to original breach or infected host | 4 |
| Public App Exposure to Malware/Botnets | Identify infected users with access to your apps | 2 |
| Malicious Campaign Analysis | Profile of criminal campaign + supporting indicators | 10 |
| Actor Infrastructure Analysis | Identify infrastructure referenced in actor artifacts | 5 |
| Insider Risk (from Work Email) | Build user exposure profile from work email | 4 |
| Insider Risk (from Reused Password) | Actor correlation from a reused password | 4 |
| Large Data Pull | Request generating 5K–10K queries | 10 |
For non-standard requests, we’ll provide a quote before proceeding.
🎓 Analyst Training Course
Course: Cybercrime Investigations with SpyCloud
Hands-on, in-person training designed to help your team operationalize SpyCloud data and workflows.
Topics:
- Overview of open research + SpyCloud data
- Understanding recaptured data & actor behavior
- Using Maltego transforms + Jupyter notebooks
- Attribution & campaign correlation
- Reporting + communicating findings
- Q&A + advanced techniques
Format:
- 🎓 Led by experienced SpyCloud Analysts
- 🏫 Held onsite at SpyCloud HQ
- 🛠️ Hands-on exercises with SpyCloud tools
- ⏳ 2.5-day course, includes lunch + snacks
- 💻 Access to Maltego + Jupyter included
- 🔐 Available to Investigations customers only
📬 Need Help or Want to Register?
Contact your SpyCloud Customer Success Manager or email
📧 [email protected] to:
- Purchase Analyst Credits
- Submit an RFA
- Request training availability
Updated 3 months ago