Advance Dismantles Social Engineering Campaigns at the Source

Overview

Advance is a family-owned holding company and private equity firm whose portfolio includes some of the world's most iconic media, entertainment, technology, lifestyle, and news brands.

As generative AI continues to collapse the attack timeline from days to minutes, Advance faced a massive evolution in social engineering sophistication. Attackers were executing flawlessly formatted, highly coordinated multi-channel campaigns that completely mimicked trusted brands and bypassed traditional filters.

To defend their employees, their portfolio, and the consumer trust that anchors their media brands, Advance partnered with Doppel to shift their defensive posture from passive, inbox-only containment to upstream infrastructure disruption.

Pull quote

"The best thing about the experience with Doppel is the speed. Whether it's domains or social media accounts, being able to see immediate movement and action on them is something we were simply not getting from previous providers."

— Christopher Smedberg, Director of Cybersecurity, Advance

Modern exploitation demands an active defense

Christopher Smedberg, Director of Cybersecurity at Advance, describes his role as securing the corporate enterprise while continuously helping the firm’s diverse portfolio companies mature their defenses and mitigate risk.

Protecting an umbrella of world-renowned brands means defending an expansive, highly distributed digital footprint. Because consumers seek out and believe content from brands they deeply trust, maintaining reputational integrity is the baseline of business success across Advance's media portfolio.

"You are going to believe and consume content from the people that you trust the most,” Smedberg says of the unique stakes of their industry. “So maintaining that trust and reputation with the consumer is extremely important for our media brands. With so many options, one slip-up can cause a significant impact."

Attackers understand that human endpoints and external brand assets are the easiest backdoors into corporate environments. Standard blast phishing evolved into sophisticated multi-channel operations, such as flooding an employee's inbox while simultaneously placing a lookalike vishing call to the corporate helpdesk.

Smedberg notes that these tactics have fundamentally heightened security risks: "The ability to scale a sophisticated multi-channel attack without the restraints that attackers previously had of human resources or native English speakers, that's getting scary."

Previously, Advance relied on a mixture of legacy attack surface management and generic threat intelligence tools. The workflow was fragmented, delivering highly varied and inaccurate data sets that forced internal teams to manually deduplicate alerts.

Worse, when the security team found a malicious domain or fraudulent social media profile, they were not able to respond quickly. Simple domain takedowns would drag on for 30 days or fail entirely, and submitting fraudulent accounts to platforms like Meta resulted in little to no action. Security teams were forced to rely on grueling, manual legal cease-and-desist processes that killed internal momentum.

Taking the fight upstream with Doppel

To establish a unified perimeter across their distributed enterprise, Advance deployed Doppel. Because Doppel operates out-of-band via lightweight API integrations, onboarding was completed in minutes by providing a single baseline asset ledger.

“Actually getting Doppel the information they needed to start providing value, that was minutes," says Smedberg. "It was a single email."

Doppel immediately broadened Advance’s visibility, utilizing the Doppel 360° Threat Graph to map out malicious domain registrations, fake corporate profiles, and executive impersonations across the web.

Instead of handing off static Indicators of Compromise (IOCs) for analysts to review, Doppel’s agentic framework immediately narrowed the triage funnel. It tied incoming email anomalies directly to verified external infrastructure, empowering Advance to initiate coordinated, multichannel takedowns that eradicated the threat at the registrar and social media platform layers simultaneously.

Smedberg explains: "We feel really good about having the agentic automation narrow that funnel for us, that we can take in a really wide array of signals and get that down to something manageable to the human."

And by integrating Doppel's automated Phishing Triage workspace, Advance replaced slow, boilerplate employee feedback mechanisms with an automated, threat-informed loop. User-reported emails are analyzed in seconds, translating real-world attack signals directly into active detection policies while continuously hardening the human layer.

Measurable security outcomes

Advance shifted from successfully executing roughly 10 difficult takedowns a year to validating and launching over 150 in their first year and 250 in their second. This volume continues to scale exponentially into 2026 as Advance safely moves toward fully autonomous takedown buckets.

Domain takedown timelines also plummeted from an average of 30 days down to under a week, permanently choking off attacker ROI and stopping repeat campaigns before they could scale.

In addition, Doppel's multi-tenant model allows direct security personnel at individual portfolio companies to access, investigate, and action their own data. Simultaneously, corporate leadership maintains centralized, aggregated visibility across the entire firm.

The sheer speed and effectiveness of Doppel's platform built an active security culture. Seeing real-time execution motivated internal security and legal teams to prioritize reviews faster, shifting the organization into a proactive defensive posture.

Why it matters

The real impact of a successful brand protection program is in how it helps cybersecurity partner with the broader enterprise. Previously, inefficient workflows and failed takedowns caused internal friction, draining momentum and discouraging legal and security teams from pursuing brand abuse.

Doppel transformed cybersecurity from a reactive cost-center into a highly valued business partner. When internal stakeholders witness fraudulent social media accounts and domains permanently removed in less than a week, it triggers an actual behavioral shift, not just improved click rates.

"When the teams internally see the success of a takedown, it motivates them to prioritize it more and do that work faster," says Smedberg.

This success has effectively broken down silos, enabling the security team to extend platform

access across Advance's distributed portfolio. Instead of corporate leadership constantly pushing teams to care about brand safety, individual portfolio companies are actively logging in to take ownership of their own digital identities.

The next frontier of human resilience

Looking ahead, Advance recognizes that security can’t rely on technical blocks alone. Even the strongest external perimeters fail if an employee is successfully manipulated into bypassing conditional access or downloading remote software.

Good defense requires a balance between robust technical controls and continuous human hardening. To build an enduring culture of communication, Advance is actively evolving its boilerplate phishing initiatives into a comprehensive social engineering defense program.

"Attackers are looking for that easy backdoor," explains Smedberg. "You can have all these controls in place, but if somebody picks up the call, it’s a done deal.”

Staying resilient requires a threat-informed loop that connects external threat mitigation directly with internal training. By leveraging Doppel’s Phishing Triage workspace, real-world attack signals submitted by employees are analyzed in seconds. These actual threat patterns are then used to build realistic, department-specific training scenarios.

"Connecting what we see in the wild with the training we deliver gives us the confidence that we are testing the right things," says Smedberg.

Advance’s co-innovation partnership with Doppel continues its evolution. Advance collaborates closely with Doppel’s customer success and engineering teams weekly to align real-world feedback with the platform's roadmap. Looking ahead, this collaborative partnership will focus on scaling automated email triage and response features to match adversary automation. By ensuring technical controls and human behaviors evolve in lockstep, Advance is transforming its workforce into a powerful human firewall.

"What stood out to me the most about Doppel has been the partnership we've developed,” notes Smedberg. “I’ve been impressed with the ability to provide feedback to the team and quickly see that realized in the platform to fit our needs."

About Advance

Advance is a private, family-held holding company and private equity firm that owns, operates, and invests in a highly diversified portfolio of market-leading companies spanning print media, digital communications, and live entertainment.