Bolster AI Threat Graph connects related threats and infrastructure, giving security teams a clearer picture of the attacks targeting their customers and more opportunities to disrupt them.
A security team discovers a phishing site impersonating its brand. They investigate, confirm it’s malicious, and take it down. But what about the other domains the attacker registered? The additional phishing sites using the same infrastructure? The related activity that hasn’t triggered an alert yet? Removing the first site addresses the threat you found. It doesn’t necessarily address everything connected to it.
For security teams managing hundreds or thousands of external threats, those connections matter. They reveal where an investigation should go next, what additional infrastructure deserves attention, and whether seemingly separate incidents are part of a broader operation.
Today, we’re introducing Bolster AI Threat Graph, a new capability within Bolster AI Signals that brings those connections directly into the investigation process.
From One Threat to the Broader Operation
Attackers have become remarkably efficient at building and distributing fraudulent experiences. AI makes convincing impersonations easier to produce. Automation allows attackers to launch and replace malicious assets quickly. Digital advertising, social media, and other distribution channels give them more ways to reach potential victims.
A single fraud operation might involve multiple lookalike domains, phishing websites, and supporting infrastructure. Those assets may appear in different investigations, even when they’re connected behind the scenes. Threat Graph gives analysts a way to explore those relationships.
Starting with a detected threat, analysts can visualize connected artifacts and infrastructure, follow the relationships between them, and identify additional activity to investigate. For example, an investigation into one phishing domain might reveal other domains associated with the same infrastructure. What began as a single takedown request becomes an opportunity to investigate several related assets and determine whether further action is warranted.
That’s a meaningful change in how external threats are investigated. Instead of relying on individual alerts to reveal each piece of an operation, analysts can use the connections behind an initial finding to guide their next steps.
One Fraudulent Support Page. Four Brands Targeted.
In a recent investigation involving one of the world’s largest antivirus companies, what initially appeared to be a single fraudulent customer support page turned out to be part of a much larger scam operation.
Investigators used Bolster AI Threat Graph to follow a phone number associated with the fraudulent page. That number connected to 57 domains, leading to the discovery of additional fraudulent websites, social media profiles, and business listings promoting the same scam. The investigation didn’t stop there. Further analysis revealed that the infrastructure was being reused to impersonate multiple brands. The full investigation uncovered:
- 225 malicious URLs
- 79 domains and hostnames
- 25 scam phone numbers
- 4 brands targeted
All from an investigation that started with a single fraudulent support page.
Without connecting these relationships, the individual websites and listings could easily have been missed and these impersonations could have continued scamming customers. Threat Graph gave investigators a way to trace shared infrastructure and understand how the operation extended beyond the original finding. The findings also gave security teams a clearer picture of which assets were connected and where coordinated mitigation efforts could be focused, rather than treating each malicious URL as an unrelated threat.
Connected Intelligence, Built Into the Response
Threat Graph is part of Bolster AI Signals, which brings threat intelligence and investigative context into the Bolster AI platform. Signals helps security teams identify suspicious and emerging activity. Threat Graph connects related threats and infrastructure so analysts can investigate the relationships behind what they’ve discovered. And because that intelligence sits within the broader Bolster AI platform, findings can inform the same discovery and takedown workflows teams already use to protect their customers.
An analyst who uncovers additional malicious infrastructure isn’t left with a diagram and a separate process for deciding what happens next. The investigation provides context for further review and action. That connection between intelligence and response is central to what we’re building at Bolster AI. Security teams need to understand the threats they’re facing, but they also need to do something about them.
See the Campaign Behind the Threat
AI has changed how quickly attackers can create, personalize, and distribute fraud. Defenders need to be able to investigate beyond the individual websites, domains, and accounts those operations leave behind. Threat Graph gives security teams a way to do that, bringing relationships between threats and infrastructure into view and making connected investigations part of their existing workflows. We’re excited to put this capability in the hands of more security teams and continue building on what we’re learning from customers already using it.
Bolster AI Threat Graph is available within Bolster AI Signals. → See Threat Graph in Action
