Systems and Methods for Threat Discovery Across Distinct Organizations

A system for threat detection across a series of clients of a client base, comprising:

• at least one storage for storing forensic information obtained from monitoring networked systems of one or more clients of the series of clients;
• and
• at least one digitally programmed processor executing instructions stored in a memory and operable to:
• access the forensic information obtained from security monitoring of one or more clients of the series of clients;
• associate the accessed forensic information with one or more selected or defined indicators of compromise;
• determine a plurality of similarity scores at least partially representative of a fidelity for the one or more selected indicators of compromise;
• generate risk scores for each client of the series of clients for each indicator of compromise;
• cluster the series of clients into a plurality of threat clusters based at least in part on the risk scores and/or additional clustering information;
• wherein upon a determination that a client of the series of at least one client has been exposed to or is likely to be exposed to a threat or attack, the processor is operable to generate an alarm and/or take remediating or preventative action for one or more additional clients in the threat cluster of the at least one client.