TG1 – Threat Sharing & Analysis

The operational intelligence function combines trusted sharing, identity business threat analysis and continuous monitoring. Its scope extends beyond incident reporting to emerging fraud methods, technologies and attacker capabilities affecting identity and (Qualified) trust services.

• TLP-based sharing of threats, attacks and modes of operation.
• Identity Business Risk Analysis and collective analysis of identity fraud.
• Deepfakes, generative AI, injection, morphing and presentation attacks.
• Enrolment compromise, identity document fraud, vulnerabilities and exploitation scenarios.
• Monitor the state of the art, share effective countermeasures and identify topics requiring further testing.

• Threat Alerts and Threat Notes for identity business
• Anonymised Incident / Attack Reports
• ID Threat Landscape and State-of-the-Art Reports
• ID Countermeasure Notes and Technical Advisories

The Steering Committee coordinates the groups and validates critical deliverables before adoption or external use. Confidentiality rules apply to operational information and its distribution.