Passive, respectful recon · six findings · 2026-07-10
Everything a security company sells reduces to one word: proof. Here is where Inter-Con's public proof is legible, and where a verifiable layer would compound it.
This is an honest read of Inter-Con's public surface as any prospect, government buyer, auditor, or AI encounters it, gathered passively, no probing, no portal access. It credits a genuinely clean estate first, then names six opportunities that all trace to the same primitive EcoWealth builds: tamper-evident, machine-verifiable proof. Finding 1 is anchored in public DNS evidence and reinforced by Brandon's own first-hand, attributed note as an Inter-Con security staffer; no internal email text or URL is reproduced or invented.
◆ Credit where due: the baseline is clean
All six public pages we rendered returned HTTP 200 with zero page errors. Inter-Con runs a modern, maintained WordPress estate on WP Engine behind Cloudflare, with valid Yoast sitemaps and an open, non-hostile robots.txt. Notably privacy-clean for the sector: analytics are self-hosted (wp-statistics), no Google Analytics, no Meta pixel, no data-broker mesh; our rendered visits loaded no third-party tracking hosts. Cookies are HttpOnly; Secure; SameSite. And Inter-Con already operates real capability: a proprietary Resource Management System (RMS), an embedded/remote GSOC, and a published TCFD climate report. The findings below are opportunities on top of a solid base, not defects in a broken one.
The bottom line, in plain English
No jargon: everything Inter-Con sells reduces to proof; here's what each fix below is worth.
A receipt an auditor can check → contracts kept on evidence, not on Inter-Con's word
Coverage %, response times, and incident handling are self-attested today, so a client audit or an SLA-credit dispute comes down to trusting Inter-Con's own system; a tamper-evident receipt both sides can read is the strongest ground for keeping the account.
Machine-legible capabilities → a sourcing AI can actually shortlist Inter-Con
More enterprise and government sourcing now starts with an assistant shortlisting vendors, and Inter-Con's sectors and certifications aren't machine-readable, so a strong firm is easy to miss; structuring them puts Inter-Con in the shortlist.
A structured intake → a live opportunity reaches Inter-Con instead of stalling
There's no machine-navigable way for a buyer's system to hand Inter-Con an RFP today, so inbound stalls at a generic contact card; a real intake routes the lead straight in, already qualified.
Close the email-spoof and header gaps → the security brand's own door models what it sells
Inter-Con's email can be spoofed and its site ships none of the basic web hardening it's hired to provide; closing both means the front door demonstrates the discipline clients pay for, and no partner gets fooled by a forged message.
A verifiable outcome under the climate report → the ESG claim becomes checkable
The TCFD disclosure is a footer-buried PDF with nothing verifiable beneath it; a checkable outcome turns an ESG claim that more contracts now weight into something a buyer can confirm rather than take on faith.
The findings
Inter-Con email can be spoofed without a hard backstop: the verifiable-trust gap, evidenced from public DNS
lead · trust & authenticity · DNS + header evidencedWhat a recipient sees
An email that says it's from Inter-Con, legitimately sent from several different providers (Microsoft 365, Mailchimp, Salesforce). To confirm it, a human eyeballs the sender and the link; a secure email gateway checks DNS. Both currently get a soft, non-enforcing answer.
Why it matters most here
Phishing is, precisely, a verification failure. For a company whose entire product is trust, "our own real mail isn't hard-verifiable, and a spoof isn't hard-blocked" is the most on-brand possible gap to close.
Credit first, from public DNS: Inter-Con does publish SPF and DKIM, and a DMARC record that is actively monitored (aggregate + forensic reports flow to Proofpoint). That's real hygiene. The gap: the DMARC policy is p=none, monitor only. It tells receiving mail servers to take no action on a message that fails authentication, so a direct-domain spoof of @icsecurity.com is not quarantined or rejected. SPF ends in ~all (softfail, not hardfail). And there's no security.txt at either standard path to tell anyone how to report a suspected impersonation.
$ dig +short TXT _dmarc.icsecurity.com "v=DMARC1; p=none; rua=…@…proofpoint.com,…@…dmarc-report.com; ruf=…" # monitored, NOT enforced $ dig +short TXT icsecurity.com # SPF "v=spf1 a:dispatch-us.ppe-hosted.com include:spf.protection.outlook.com include:_spf.salesforce.com include:servers.mcsv.net … ~all" # softfail $ dig +short TXT selector1._domainkey… # DKIM v=DKIM1; k=rsa; p=MIGf… # DKIM present (M365 + Mailchimp k1): good $ curl -s -o /dev/null -w "%{http_code}" …/.well-known/security.txt · …/security.txt 404 404 # no published channel to report/verify a suspected impersonation
And the multi-sender reality compounds it: Inter-Con legitimately sends from third-party infrastructure, servers.mcsv.net (Mailchimp), _spf.salesforce.com (Salesforce), ppe-hosted.com (Proofpoint), and its own client/employee portal lives at icsecurity.my.site.com (a Salesforce domain). All legitimate, but it means a genuine Inter-Con message often rides a domain a recipient can't verify as Inter-Con at a glance, the exact condition under which people learn to click things they shouldn't.
First-hand operator note (attributed, not an artifact we hold): Brandon works in security at Inter-Con and reports that internal security-awareness / anti-phishing emails to staff are poorly formatted and route through third-party URLs that don't inspire confidence they're genuine, ironically making the anti-phishing program itself look like phishing. We take that as his direct observation; per our safety line we do not reproduce, quote, or fabricate any specific email text or URL, and the finding above stands on public DNS evidence alone.
The fix EcoWealth brings: two moves. Move DMARC to p=quarantine→reject so spoofs are hard-blocked (a config step Inter-Con already has the monitoring data to make safely), and, the part only EcoWealth adds, attach a tamper-evident authenticity mark to genuine messages so a recipient or their AI confirms it's real and a forgery fails closed, regardless of which provider sent it. Shown as Front A of the demo.
Zero transport-hardening, anti-framing, or anti-sniffing headers, on a security brand's own site
site security · fully evidencedWhat happens
The six response headers a modern browser looks for to enforce HTTPS, block click-jacking, stop MIME-sniffing, and constrain scripts are all absent, confirmed both by curl and by a real Chrome navigation.
Why it matters
Individually low-severity; collectively it's the first thing a buyer's or partner's own security-diligence tooling flags, and an easy, high-symbolic-value win for a firm that sells hardening.
MISSING strict-transport-security # no HSTS: downgrade / SSL-strip surface MISSING content-security-policy # no CSP: no script allowlist MISSING x-frame-options # framable: clickjacking surface MISSING x-content-type-options # MIME-sniffing not disabled MISSING referrer-policy # full referrer leaks cross-site MISSING permissions-policy # camera/mic/geo not constrained present server: cloudflare · x-powered-by: WP Engine · set-cookie: HttpOnly; Secure; SameSite
Framed as opportunity: every one of these is a header-level configuration change at the Cloudflare/WP Engine edge, no rebuild. HSTS + a starter CSP + X-Content-Type-Options: nosniff + X-Frame-Options: SAMEORIGIN is an afternoon, and it makes the site pass the exact scan a security buyer would run on their vendor.
Capabilities, sectors, and certifications aren't machine-legible: the procurement AI can't represent Inter-Con
lead · procurement legibility · fully evidencedEvery page we rendered carries only Yoast's default structured-data graph: WebPage, WebSite, BreadcrumbList, and a skeletal Organization. There is no Service, GovernmentService, Offer, or EducationalOccupationalCredential schema anywhere. The Organization node has no sameAs, no contactPoint, no address, no hasCredential, no areaServed. For a 40,000-person global firm winning government and enterprise contracts, an AI asked "what does Inter-Con do, where, and with what certifications" has nothing structured to read, it must scrape prose, or guess.
page ld+json types home 1 WebPage, WebSite, BreadcrumbList, Organization, ImageObject industries/government 1 (same Yoast default graph) company/certification 1 (same: a certifications page with 0 credential schema) security-services/technology 1 (same) innovation/gsoc 1 (same) Organization node (home) → { name, url, logo } // no sameAs / contactPoint / address / hasCredential Service | Offer | GovernmentService | Credential schema → NONE on any page
The certification page is the sharpest example: it is thin and logo-only, the images carry empty alt text, so neither a screen reader nor an AI can name a single certification Inter-Con holds.
alt='' src=…ic-logo-white.svg
alt='Inter-Con Security' src=…intercon-security-logo.svg
alt='' src=…logo-intercon-white.svg
alt='' src=…logo-peacemaker.svg
# 4 of 5 images have empty alt; page renders no machine-readable certification data
The fix: the Agent Kit publishes Inter-Con's services, sectors, clearances, and certifications as structured Service / Organization / credential data plus an llms.txt, so a buyer's RFP-answering AI returns Inter-Con accurately, with a citation.
Proof-of-operations is self-attested: a client or auditor still has to take Inter-Con's word for it
lead · proof of work doneCredit first: this capability is real. Inter-Con's own pages describe a proprietary Resource Management System (RMS) giving management "real-time management of all post assignments, ensuring 100% coverage," plus embedded and remote GSOC operations. That is a genuine operational backbone, and better than most peers.
RMS "…real-time management of all post assignments, ensuring 100% coverage. …advanced asset tracking models and comprehensive datasets to forecast seasonal deployments and emergency response demands." GSOC "…fully embedded and remote Security Operations Centers to support the local, regional, and global activities of our clients."
The gap
Every record RMS/GSOC produces, a completed tour, a post attendance log, an incident report, is self-attested. A client's audit team or a government contracting officer can't independently verify that a patrol happened at 02:14 at that location without trusting Inter-Con's own system end-to-end.
Why it matters
State Department, GSA, critical-infrastructure, and transit contracts increasingly demand tamper-evident, replayable audit trails. Whoever can hand the auditor proof they can check themselves, not a report to trust, keeps the account and settles the SLA-credit dispute on evidence both sides can read.
The fit is exact. A guard tour with GPS + timestamp + photo, an incident report with method-template completion: that is precisely the shape of an EcoWealth work packet: funded, photo + GPS + method-verified, settled into a tamper-evident receipt anyone can replay. This is the Ecological Work Protocol pointed at security operations, and it's live on Base mainnet today. Shown as Front B of the demo.
The procurement front door has no structured intake
discovery · fully evidencedWhat happens
The public Sales contact page renders zero form elements after full page load; contact routes through generic "How Can Inter-Con Serve You? → Work With Us" cards. There is no visible RFP intake, capability-statement endpoint, or machine-navigable "request a proposal" path.
Why it matters
A large share of enterprise and government sourcing now begins with an assistant shortlisting vendors. If there's no structured way in, an assistant can't easily route a live opportunity to Inter-Con, even though Inter-Con is the stronger firm, the lead stalls for lack of a clean intake.
/contact-us/sales/ forms rendered: 0 · mailto/tel links in body: 0 # contact is routed through two generic navy cards, not a structured inquiry/RFP intake
The fix: a small structured intake plus an agent-card.json "request-proposal" action, so a buyer's AI can hand Inter-Con a scoped opportunity directly, covered in the Agent Kit.
A real climate disclosure: PDF-only, footer-buried, with no verifiable outcome beneath it
ecological plug · fully evidencedCredit first: Inter-Con publishes a TCFD climate report (dated Dec 2025), genuinely more than most guarding firms do. But it lives as a single 349 KB PDF linked only from the site footer as "Climate Risk Assessment," with no structured data and no proof-verified, on-chain outcome layer under the numbers.
footer "Climate Risk Assessment" → /wp-content/uploads/2025/12/Inter-Con-TCFD-Report-12.12.2025.pdf $ curl -sI …Inter-Con-TCFD-Report-12.12.2025.pdf HTTP/2 200 · content-type: application/pdf · content-length: 357554 # 349 KB, unstructured
The fit: EcoWealth's tCO2e-receipted work packets, native carbon retirement on settlement, can put settled, citable outcomes under a climate disclosure. A security firm with a global vehicle fleet and thousands of sites has real footprint and real reduction opportunities; proof-verified receipts turn a PDF number into an auditable line. Secondary to the trust and proof-of-operations leads, but a clean on-ramp to EcoWealth's ecological core.
Evidence log: every claim, its method and date
| # | Claim | Method | Evidence |
|---|---|---|---|
| 1 | DMARC published but not enforced (monitor-only) | dig +short TXT _dmarc.icsecurity.com | v=DMARC1; p=none; rua/ruf→proofpoint: spoofs not quarantined/rejected |
| 1 | SPF softfail, DKIM present | dig +short TXT icsecurity.com · selector DKIM | SPF ends ~all · DKIM selector1/2 (M365) + k1 (Mailchimp) valid |
| 1 | Genuine mail rides third-party domains | SPF includes + page hosts | servers.mcsv.net (Mailchimp) · _spf.salesforce.com · portal icsecurity.my.site.com |
| 1 | No security.txt at either standard path | curl both paths | /.well-known/security.txt 404 · /security.txt 404 |
| 2 | Six hardening headers absent | curl -sI + Chrome render | HSTS / CSP / XFO / XCTO / Referrer-Policy / Permissions-Policy all null |
| 3 | No Service/credential schema; cert page logo-only | Playwright rendered-DOM | ld+json = Yoast default only on 6/6 pages · cert alt='' on 4/5 imgs |
| 4 | RMS/GSOC real but self-attested | page-content read | their own copy: "100% coverage," "embedded and remote SOC" |
| 5 | Sales page has no structured intake | Playwright rendered-DOM | forms = 0 · no mailto/tel in body |
| 6 | TCFD report is PDF-only, footer-linked | curl -sI | 200 · application/pdf · 357,554 bytes |
| N/A | Baseline: clean, privacy-respecting | Playwright + headers | 200/0-pageerror ×6 · 0 third-party hosts loaded · self-hosted analytics · WP Engine/Cloudflare |
Honesty note. Our raw probe logged ~10–12 console / failed-request entries per page, those were induced by our own webfont blocking during screenshotting, not Inter-Con defects. The meaningful signal is pageerror = 0 on every rendered page.
How a company like Inter-Con wins & runs work, and where a verifiable-proof layer fits
Contract security is won on past performance, certifications, clearances, and price through competitive procurement, then run across a large distributed guard workforce against client SLAs and audit. Every stage rests on proof someone else has to trust. That is the seam.
1 · Winning the work: procurement & RFP
Government via GSA Schedules / SAM.gov / State & local RFPs; enterprise via RFP + capability statement + past-performance + certifications. Inter-Con is a GSA-schedule holder serving the public sector since its first NASA contract ~50 years ago (Diplomatic, Transit, Energy, Museums, Education).
plug → machine-legible capability/cert data (Findings 3, 5)2 · Running the work: a distributed workforce
40,000+ officers across North America, South America, and Africa, coordinated by RMS for post coverage and GSOC for monitoring. Thousands of client sites, shift by shift, tour by tour: an enormous stream of operational events that must be evidenced.
plug → tamper-evident tour / incident receipts (Finding 4)3 · Keeping the work: SLA & audit
Retention hinges on demonstrable performance: coverage %, response times, incident handling, reviewed in client audits and contract re-competes, sometimes in disputes over SLA credits.
plug → replayable proof the client verifies themselves (Finding 4)4 · The trust surface: comms & brand
A firm selling trust is uniquely exposed to impersonation of its own messages: to staff, to clients, to the public. Making genuine Inter-Con comms machine-verifiable defends the brand and models the product.
plug → tamper-evident authenticity mark (Findings 1, 2)The day-one efficiency: no Inter-Con system change to see it
The same buyer, auditor, or staff-member interaction, before and after the verifiable-proof layer, measured in trust established without a phone call.
Today
- A gov buyer's AI asks "what certifications and clearances does Inter-Con hold, and where?" → scrapes prose, or declines: no structured answer exists.
- A client auditor asks "prove the overnight patrols ran last month" → receives a report to trust, not proof to check.
- A staff member gets a "security awareness" email through a third-party URL → can't tell it from a scam, so ignores it or, worse, trusts a real scam next time.
With the Kit + Protocol
- The same question returns a cited capability answer: services, sectors, certifications, clearances, straight from Inter-Con's own structured data.
- The auditor gets replayable, tamper-evident receipts: GPS + time + photo + method per tour, they verify independently, on-chain.
- Every genuine message carries a machine-verifiable mark; staff are trained to trust nothing without it. A forgery fails closed.
The proposal
Your dedicated provisioner starts with Week 1: no system access needed.
The findings are opportunities on a clean base, and they share one root: verifiable proof, which EcoWealth already runs on Base mainnet. As Inter-Con's dedicated provisioner: Week 1 makes comms authentic (publish security.txt, DMARC p=none→enforcement, a verifiable-message mark); Month 1 runs proof-verified tours on one client site; Quarter 1 ships RFP-legible capability data, each deploying on EcoWealth infrastructure first. The full plan is on the hub; the two-front demo runs it in Inter-Con's own navy.
