Independent engineers hold something clients rarely think about: keys. A freelancer with deploy access, cloud consoles and a password vault is a tempting stepping stone into several organisations at once. ThreatOps, the practice the Ops Atlas describes as running threat intelligence and hunting as a single operation, scales down surprisingly well to a one-person business. What follows is an audit that fits in one afternoon, split into five blocks, with a pass or fail mark for each line.

Block A: Decide what you need to know

A solo operator cannot follow everything, so write down a short list of questions first. The Atlas calls these priority intelligence requirements and wants five to eight at most, each built around one question, one fact and one decision. For a freelancer the list might be modest and concrete.

1. Which of my accounts would an attacker try first, and what would a misuse look like?
2. Which scams currently target contractors with access to client systems?
3. Which remote-access routes I rely on are being abused this quarter?
4. Which client environments have I touched that I could not describe from memory?

Pass mark: the list exists in a file, each line names the decision it informs, and you have a date in the calendar to review it each quarter. Fail mark: you carry the list in your head, which means it is really a vague worry.

Block B: Rate what you read

You will meet warnings in newsletters, forums and vendor bulletins. Before acting on one, label it. The scheme the Atlas cites pairs a reliability letter, from A for a source with a strong record down to F for an unknown, with a credibility number from one to six for how plausible the item looks on its own. A familiar provider’s brand-new claim might score A3.

• Do you keep a list of the five or six sources you trust, with a letter beside each?
• Do you note, when you act on an item, the number you gave it?
• Do you throw away or downgrade sources that repeatedly turn out to be noise?

Pass mark: at least the sources you act on are rated, and the rating changes when evidence changes. Fail mark: anything that arrives in capital letters gets the same urgency.

Block C: Make indicators expire

If you maintain a personal blocklist or a snippet file of suspicious domains, it is aging as you read this. The standard sharing format makes expiry optional, which the Atlas flags as a trap: without a deadline, entries live indefinitely. Its sample policy is short: network addresses lapse after a fortnight, links after about a month, domain names after two months, and file fingerprints are kept for twelve months.

• Does every entry carry an add date and an expiry date?
• Do you review the list on a fixed day, deleting what has lapsed?
• Do you refuse to block anything automatically on a source you have not rated highly?

Pass mark: nothing on your list is older than its lifetime. A particularly useful habit for a freelancer is to apply alert-only handling to any shared-hosting address, since blocking one could cut off a client’s perfectly legitimate service.

Block D: Run one small hunt per month

You do not need a platform to hunt. You need a hypothesis and some records. The PEAK method the Atlas cites suggests four prompts: the likely actor, the behaviour to look for, the place it would surface and the evidence that settles it. Keep it to one or two behaviours. A reasonable first target for a freelancer is sign-ins to your own accounts from places you have never worked.

1. Write the hypothesis in two sentences.
2. Check the logs you can actually reach; note how far back they go.
3. Close the hunt with exactly one of four outputs: a request to add an alert, a ticket for data you lacked, an escalation to someone with authority, or a short note confirming you would have noticed.
4. Ask yourself the acceptance question the Atlas poses: could somebody who did not take part rerun this and get the same answer?

Pass mark: a written artefact exists every month. Remember that finding nothing is not failure. If your records would have shown the behaviour, a negative result is a confident answer. If the records stop two weeks back, the finding is a gap, and the fix is to extend retention.

Block E: Share with discipline

The last block is the one most freelancers skip, and it is where a network pays off. Peers hear about scams before you do. Sharing needs rules, though, and the Atlas points to the traffic-light protocol: red stays with named recipients, amber within the organisation and trusted partners, green with the community, clear with anyone. Forwarding amber material beyond its intended circle is on the Atlas’s list of classic errors. If you are still building that circle, assembling a dependable network of peers and mentors is a good first project, because a warning channel is only as good as the people on it.

• Do you know the four colours and what each permits?
• Do you check client contracts before passing on anything that came from their environment?
• Do you belong to at least one sharing group where reports flow both ways?

Pass mark: you can say, for any piece of information you hold, how far it is allowed to travel. Note that the Atlas also pushes back on blanket silence, calling “sharing is risky, so share nothing” a myth that colour labels and pre-agreed categories can solve.

A short scenario to calibrate the marks

Take a generic contractor who maintains pipelines for three small clients. Her requirement list has four lines. She trusts two newsletters, rated B and C, and one peer group, rated B. In March a peer warns about phishing messages that imitate a code-hosting service’s security notice. She scores the claim a 2 because two independent peers saw the same lure, searches her mailbox and sign-in history for matching behaviour, and finds nothing, though she notices her logs reach back only three weeks. The hunt note records a confident negative for those three weeks and a gap ticket to extend retention. She posts a green-labelled summary to her peers. That is a passing run through blocks A, B, D and E in under two hours, and no special equipment was involved.

Scoring yourself and telling clients

Count the passes per block rather than adding everything up. A freelancer who passes four blocks and fails the hunting one has a clear next step. Clients also respond well to evidence of method. When you explain why you rotate credentials, expire indicators and keep a hunt log, you are doing the quiet work that, as described in a practical guide to earning the confidence of first-time clients, turns a one-off job into a lasting relationship. Keep the claims modest. Your records show what you checked and what you found, not a guarantee that nothing is wrong.

Three numbers from the Atlas worked quarter are worth borrowing for your own review: how many of your requirements had an answer, how much of what you read led to an action, and how many hunts ended in an artefact. Avoid counting items read or tools installed; those figures grow without making anyone safer.

Next steps

If the audit turns up more failures than you expected, start with Block A and Block C, which cost only time. The detailed ThreatOps entry in the Ops Atlas includes the thirty-sixty-ninety-day plan that this audit condenses, along with the maturity ladder if you ever grow into a small team. Print the five blocks, mark them honestly, and book your first monthly hunt before the week is over.