A look at SOC Prime's cookie disclosures shows the security vendor's site sets a stack of third-party tracking cookies from ad-tech platforms, including AddThis and Lotame's audience-segmentation tools. The list, drawn from the vendor's own privacy page, covers behavior tracking, demographic segmentation and cross-site recommendation features.
For a company that sells detection content to security teams, the optics are awkward. Practitioners who obsess over endpoint telemetry now have to think about what their own vendors are doing in their browsers.
What the cookies actually do
The disclosed cookies fall into a few buckets. Some, like tuuid and _cc_id, collect anonymous visit data such as number of visits, time on site and pages loaded. Others, like na_sc_x from AddThis, record which pages a visitor has seen in order to recommend other content across the network. The Lotame cookies (_cc_aud, _cc_cc, _cc_dc, _cc_id) segment users by factors such as demographics and geography to support personalized advertising.
There are also sync identifiers like APID and IDSYNC, which stitch a user's profile across different ad-tech systems. None of this is unique to SOC Prime. It is standard issue for a site that runs display advertising.
Why this matters
Security professionals are increasingly the targets of well-resourced threat actors. Spear-phishing works best when the attacker knows what browser, what device, what timezone, and what interests the target has. Detailed behavioral profiles built from tracking cookies are exactly the kind of raw material that makes those attacks easier.
There is also a procurement angle. Enterprise customers running SOC Prime's detection content are sending their analysts to a vendor site that fingerprints their browsing. Most security teams would not accept that from an unauthenticated endpoint. The bar should be the same for a vendor portal.
What to watch next
Expect more security vendors to publish detailed cookie disclosures as Europe's ePrivacy enforcement and US state privacy laws bite. The question is whether vendors will move beyond disclosure and start stripping ad-tech trackers from logged-in portals entirely. So far, few have.
Worked example: an analyst checking their own exposure
Say you are a detection engineer who logs into SOC Prime weekly to download content. Before you do, open your browser's developer tools, hit the Network tab and reload. Filter by requests to domains like addthis.com, lotame.com or crwdcntrl.net. If you see calls there, your browsing pattern is being shared with ad-tech networks. Block those domains at the proxy level for any analyst machine, and ask procurement to put a cookie-minimization clause in the next vendor contract.
Bottom line
Most security sites still behave like ordinary ad-supported publishers. The fix is not hard: separate marketing properties from authenticated analyst portals, and stop loading third-party trackers once a user is logged in.
Key takeaways
- SOC Prime's site uses cookies from AddThis, Lotame and other ad-tech platforms for behavioral tracking and ad targeting.
- Detailed tracking profiles on security practitioners can feed targeted phishing and reconnaissance.
- Enterprises should push vendors to strip trackers from authenticated portals and reflect that in contracts.
Frequently asked questions
What kinds of cookies does SOC Prime use?
Cookies that collect anonymous visit statistics, segment users by demographics and geography, and support cross-site content recommendations.
Why is third-party tracking on a security vendor site a concern?
Detailed behavioral profiles of security practitioners can be useful to attackers planning targeted phishing or reconnaissance.
What are APID and IDSYNC cookies?
They are identifier-syncing cookies used to link a user's profile across different advertising and data platforms.
What can enterprises do about this?
Block third-party ad-tech domains at the proxy for analyst machines and require cookie minimization in vendor contracts.
Source: socprime.com