Which company-published facts make a phishing lure credible at zero research cost?
answer
- the target publishes it themselves
- hiring adverts are the richest source
- certificates and DNS name the hostnames
- filings name who signs
- collected once, reused for forty
basics
~10 sThe organisation's own published surface: job adverts naming internal systems and approval chains, certificate transparency and DNS entries naming hostnames, regulatory filings naming who signs, and conference bios naming who reports to whom.
solid answer
~50 sA lure is believable when it describes a world the reader recognises, and most of that world is published by the company itself. Four families cover almost all of it. Job adverts name the internal expense, ticketing or payroll system by name and often describe the approval chain around it. Certificate transparency logs and DNS records name hostnames, subdomains and the mail provider, so an operator can write a link that looks like somewhere the reader has actually been. Regulatory filings and press releases name the officers who sign things, which is who an urgent request can plausibly come from. Conference talks, bios and public profiles reveal reporting lines and project names. None of it costs money, none of it requires interaction with the target, and crucially most of it is organisation-level, so it is collected once and reused for every recipient inside that organisation.
go deeper
Be ready to name concrete sources rather than saying 'public information'. Job adverts, certificate transparency, DNS, filings and conference bios, with one example of what each yields.
Explain why these facts change the reader's reaction: they place the message inside a world the recipient recognises, so the reader is matching a pattern rather than inspecting a stranger.
Show that you know the cost structure: organisation-level facts are collected once and amortised across every recipient, so the marginal research cost per extra target is small.
Own the uncomfortable half - most of this surface is published because the business needs it published, so the question is which increments to trim, not whether the surface can be removed.
### What a credibility fact is A lure fails on unfamiliarity long before it fails on grammar. The reader is not auditing the message; they are pattern-matching it against a world they know. A credibility fact is any detail that makes the message sit inside that world: the actual name of the system the company uses to reimburse expenses, the actual hostname their internal portals live under, the actual name of the person whose signature appears on payment approvals, the actual name of the project the recipient has been staffed on for three months. The economically interesting property of these facts is not that they are secret. It is that they are free, and that the company publishes them itself as a side effect of operating normally. ### The four families **Hiring material.** Job adverts are the richest single source and the least defended, because their whole purpose is to be specific. An advert for a finance analyst that says the role owns weekly runs in a named expense system has just told an outsider the name of a system every employee in that function logs into. Adverts also leak the shape of the organisation: who a role reports to, which teams exist, which office does which function. **Naming and certificate infrastructure.** Certificate transparency is a public, append-only log system: to be trusted by browsers, publicly issued certificates are logged, and the logged certificate carries the hostnames it covers. That turns an organisation's internal-sounding subdomains into a public list. DNS adds to it: MX records name the mail platform, and other records name providers the company depends on. The value to a lure writer is that a link or a sender domain can be built to resemble something the reader genuinely uses, rather than something invented. **Filings and official publications.** Company registries, regulatory filings and annual reports name officers, signatories and, for larger organisations, the internal committees and delegations. This is who an urgent instruction can plausibly be attributed to, and it is a matter of public record precisely because publication is compelled. **People-published material.** Conference talks, published bios, panel appearances and public profiles carry reporting lines, tenure, current projects and, frequently, the fact that someone is travelling next week. This is the layer that turns an organisation-level lure into a person-level one. ### Why the cost structure matters more than the list The first three families are organisation-level. Their cost is paid once and then serves every recipient inside that company. If an operator is preparing lures for forty people at one target, the expense-system name, the hostname pattern and the name of the officer who signs are collected in a single sitting and appear in all forty messages. Only the fourth family scales per person, and even there the increment is small. This is what makes 'they must have spent weeks researching us' a bad inference. The fixed part of the research is shared, and the variable part is measured in tens of minutes. ### The honest limits The public surface gives you the organisation's shape, not the recipient's current context. It will not tell you what invoice landed on their desk yesterday, what thread they are already in, or which of their colleagues is on leave. Those require either luck, timing, or something that is not free. So the public surface reliably lifts a lure from generic to organisationally plausible, and reliably fails to make it personally current. A lure that is exactly right about the company and vague about the person is the signature of a research budget that ran out. ### The common wrong answer Candidates often say their organisation publishes nothing useful. Almost no organisation is in that position, because the publication is mostly obligatory or commercially necessary: you cannot hire without adverts, you cannot serve trusted TLS without logging certificates, you cannot be a regulated company without filings, and you cannot market without speaking in public. The right question is never whether the surface exists but which parts of it carry lure value out of proportion to their business value.
- A candidate insists their company publishes nothing an outsider could use. How do you test that claim?Walk the four families out loud: current job adverts, certificate transparency and DNS entries for the domain, company filings and press releases, and public talks or bios by named staff. Most of that publication is obligatory or commercially necessary, so the surface is essentially never empty. The useful question is which published details carry high lure value and low business value.
- Which of these facts stops being reusable once the lure targets one named person?The first three families are organisation-level and appear unchanged in every message to that company. Only the person layer - reporting line, current project, travel, tenure - has to be re-read per recipient, and it is typically tens of minutes of reading. That asymmetry is why per-recipient research cost is far lower than people assume.
It is like casing a building using the architect's own published floor plan and the tenant directory in the lobby, rather than picking a lock.
saying these in an interview costs you the question
- Assumes research means breaking into something first
- Claims a low-profile company has no public surface
- Treats certificate transparency and DNS entries as private
- Believes the useful credibility facts have to be bought