Why I Built ThreatHarvest

Giving IT Managers Proactive Control

If you are an IT professional managing technology for a small or medium-sized business, you already know the reality of the job. You wear a dozen hats. You juggle a never-ending stream of past, present, and future projects, all while users and systems demand your attention today. There is never enough time. Some of your hats bring greater challenges than others, but few carry the same weight of risk and uncertainty as the information security hat. This is particularly true when considering the vast depth and breadth of threats originating from outside your network.

I know this because I am that IT professional. I’ve led IT operations, managed tight budgets, and felt the operational stretch.

The Search for Proactive Control

The origin of ThreatHarvest didn't start with a catastrophic breach; it started with the realization that I had a blind spot.

I knew that securing the internal environment wasn't enough anymore. I wanted the ability to detect early warning signs, like an exposed database, a leaked employee credential, or a compromised third-party vendor, so I could shrink the window of exposure and accelerate response. I needed a baseline safety net of external visibility.

I assumed I could just go to the market, find a cost-effective threat intelligence solution designed for a small team, and plug it in. I was entirely wrong.

The Reality of Enterprise Bloat

Researching the market for a tool to provide that visibility was an exercise in pure frustration. The threat intelligence industry is heavily driven by private equity seeking high-dollar growth. Because of this, tools are built for enterprises with dedicated security teams and massive budgets.

I experienced the point that busy IT managers dread: the opaque "Contact Us for Pricing" button. I wasted time on sales calls only to discover that baseline external monitoring solutions were priced significantly higher than the core security tools (like EDR) that provided the most tangible daily value. Even heavily discounted "SMB tiers" were unreasonably expensive, and I knew from experience that those introductory discounts disappear fast.

The industry seemed perfectly content charging massive premiums to repackage data that is often accessible via public open-source intelligence (OSINT). Small and medium businesses are the backbone of the economy. They supply the very enterprises these vendors cater to. They need affordable, right-sized solutions to implement proactive risk controls and offset their risks. Instead, they are completely priced out.

The DIY Trap

Out of necessity, I started looking into bootstrapping a threat intelligence program using free or low-cost OSINT tools.

While there are incredible public resources out there for checking open ports, monitoring domains, or spotting leaked data, the friction is immense. Keeping continuity between manual checks is burdensome. Unifying alerts from half a dozen different platforms is practically impossible. Open-source feeds frequently change, APIs break, or sites simply 404.

Doing it yourself doesn't get you closer to a consistent, repeatable process. It just adds a thirteenth hat to your already overloaded rack. I realized that there is value in paying a vendor to abstract the danger and complexity, like safely scraping the dark web or monitoring volatile communication channels, but that vendor has to align with an SMB budget.

The Proactive Payoff

The reason I refused to give up on finding a solution is because I have experienced firsthand what happens when you actually have that visibility. When you have early access to emerging external risks, you get to flip from reactive to proactive.

Throughout my career, timely threat intelligence has given me a critical head start:

The Vendor Breach: I once detected a critical vendor appearing on a ransomware blog before the vendor even knew they were mentioned. It gave me the time to research the potential impact, map out the blast radius, and walk into a leadership meeting with answers instead of surprises.

The Silent Risk: I’ve been able to proactively engage employees about leaked credentials, advocating for password resets and closing the gap before an account takeover (ATO) could occur.

Exposed Infrastructure: I’ve seen the rapid, organic sprawl of shadow IT expose dozens of ports to the outside world. Having continuous visibility allowed me to catch those open doors, formulate a plan to close, and identify when system changes created additional exposure.

These moments matter. They shrink the window between an external exposure and your mitigation response. They give you a sense of control over the chaos.

Building What Was Needed

One of the biggest challenges with threat intelligence is that the "quiet times" make it easy to forget its value. A credential leaks, and then twelve months go by before a vendor is mentioned in a breach. But when that moment hits, having the right context injected into your workflow makes all the difference.

I built ThreatHarvest to separate the actionable from the noise. It is designed to filter findings through your company's unique attributes, eliminating the alert fatigue caused by bloated enterprise feeds.

I built ThreatHarvest because I wanted it for my own operations. I’m sharing it because I know how many other IT managers desperately need it. You shouldn't need a massive budget or a dedicated security team to know your external risks. You just need the right head start.

Stay proactive,

Josh Cech
Founder, ThreatHarvest