How This Briefing Works
This report opens with key findings, then maps the gaps between what Indicative discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Analysis pending. Findings will appear here once intelligence collection is complete.
Disclosure Gaps
Claims vs. Observed Behavior
1 gaps
pending
MEDIUM
They Claim
“Requires scanner verification of runtime behavior”
Observed Behavior
Analysis based on Indicative and mParticle public documentation and acquisition disclosures
Customer Impact
What This Means For You
Organizations using Indicative should evaluate risk not just for the analytics product but for the entire mParticle ecosystem it operates within. The primary concern is data flow scope: behavioral events analyzed in Indicative exist within a platform designed to route data to hundreds of third-party destinations. This means product analytics data may be available for advertising targeting, personalization, and other uses unless explicit routing controls are configured. Data residency is also a consideration, as mParticle processes data across multiple cloud regions. Organizations must ensure their data processing agreements cover both Indicative's analytics and mParticle's broader data routing capabilities.
Recommended Actions
What To Do About It
Role-specific actions based on observed behavior
Recommended Actions for Indicative
- →- Map all mParticle data destinations to understand where behavioral events analyzed by Indicative are also being sent. - Review mParticle routing rules to ensure product analytics data is not being forwarded to advertising or marketing platforms without explicit authorization. - Evaluate consent mechanisms to ensure users understand that behavioral data may be processed by a customer data platform with broad distribution capabilities. - Audit the data warehouse connection to verify Indicative's access scope is limited to necessary tables and does not expose sensitive customer data. - Review mParticle's data processing agreement for cross-destination data sharing provisions and subprocessor obligations.
Negotiation Leverage
- →Leverage: Indicative's warehouse-native positioning implies a privacy-friendly approach (your data stays in your warehouse), but the mParticle acquisition introduces a data routing layer that contradicts this narrative. Use this tension to negotiate strict data isolation terms. Key questions: Is Indicative data isolated from mParticle's routing infrastructure or do they share the same data layer? What mParticle destinations have access to behavioral events that Indicative analyzes? Can Indicative be used independently without mParticle's data routing capabilities? Does mParticle use Indicative analytics data for benchmarking or product improvement? Protections to require: Contractual separation between Indicative analytics and mParticle data routing. Explicit prohibition on sending analytics data to advertising destinations without customer authorization. Right to audit mParticle routing configurations. Data deletion certification covering both Indicative and mParticle systems.
IOC Manifest
IOC Manifest
12 INDICATORS
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
TRACK
*www.indicative.com/cdn-cgi/challenge-platform/scripts/jsd/main.js*
Tracking script
TRACK
*www.indicative.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/*/main.js*
Tracking script
TRACK
www.indicative.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Auto-extracted from scan
TRACK
www.indicative.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js
Auto-extracted from scan
Ecosystem
Ecosystem & Supply Chain
Indicative operates within the mParticle customer data platform, which integrates with over 300 marketing, analytics, and advertising tools. mParticle serves as a data routing layer that collects customer events and distributes them to downstream destinations including advertising platforms (Google, Facebook, TikTok), analytics tools, CRM systems, email platforms, and data warehouses. Indicative connects directly to Snowflake, BigQuery, Redshift, and other warehouses. The combined platform provides customer identity resolution, audience segmentation, and cross-platform data distribution capabilities that extend well beyond product analytics.
Evidence
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
HAR Capture
Complete network capture with all requests and responses
IOC Manifest
12 detection signatures across scripts, domains, cookies, and network endpoints