July 2025

In this month's newsletter:

• Demystifying Threat Intelligence for Digital Advertisers
• New Access UNLOCKED - ANA Transparency Benchmark Results for TAG Members!
• ABCs of PMAL (Pirate Mobile App List)
• State of the Fight - IT'S BACK!
• In the News
• Where in the World is TAG
• One More Thing

 

 

TAG REPORT DEMYSTIFIES THREAT INTELLIGENCE FOR ADVERTISING COMMUNITY

Over the last two decades, hundreds of billions of dollars of marketing spend have shifted online, as digital advertising companies offered increasingly precise, measurable, and accountable tools to reach consumers. 

Following the counsel of notorious bank robber Willie Sutton -- who once told an interviewer that he targeted banks because “that’s where the money is” -- savvy digital criminals soon followed, using stolen content and corrupted ads to lure consumers, infect their computers and devices, interpose themselves into the supply chain, and steal money from advertisers.

As new criminal threats quickly metastasized, it became clear that companies across the advertising supply chain needed a common forum for threat collection, assessment, and sharing with other companies at risk, so TAG created the TAG AdSec Threat Exchange.

For marketers, however, the threat gathering and evaluation process can seem arcane and confusing, so TAG’s Threat Intelligence team has released a new report, “Demystifying Threat Intelligence in Digital Advertising,” explaining what they do and how TAG member companies can get involved.

 

An excerpt from that report follows:

Threat intelligence is knowledge gained through the collection and analysis of data related to potential or active threats. At its core, threat intelligence provides actionable insights into the threat landscape, helping organizations understand the risks they face and take proactive steps to defend against them.

Threat intelligence can generally be described as falling into one of three categories, each offering different insights and value to organizations:

Tactical Intelligence

Tactical intelligence is the most immediate and actionable form of threat intelligence. It includes specific details related to current or emerging threats, such as malicious IP addresses, URLs, file hashes, or malware samples. By identifying these “Indicators of Compromise” (IOCs), organizations can quickly block or mitigate threats in real-time.

Operational Intelligence

Operational intelligence provides a more detailed understanding of threat campaigns and attack methodologies. It includes information about how cybercriminals execute their attacks, the tools and infrastructure they use, and their targeting behaviors.

Strategic Intelligence

Strategic intelligence is higher-level information on threat trends and motivations. This type of intelligence allows decision-makers to make strategic security investments. … 

The digital advertising ecosystem is made up of several key players that work together to deliver online ads to consumers. … Each of these types of companies work together to deliver relevant ads to users online and each may be targeted by criminal elements looking to steal advertising revenue or harm users.

Since 2017, TAG has held the US Department of Homeland Security (DHS) designation as the Information Sharing and Analysis Organization (ISAO) for the digital advertising industry, making TAG the primary body facilitating the industry's threat-sharing operations.

It is important the digital advertising industry comes together to share threat intelligence – their unique piece of the puzzle – in what can be a complex supply chain. This enables the industry to block threats in real-time and understand our adversaries better, allowing us to work with partners to make a meaningful impact such as: reducing user harm; significantly increasing the cost for adversaries to operate; or law enforcement action.  

 

 

---

TAG Members Get Complimentary Access to ANA Transparency Benchmark Results

Want to dig into the results of the quarterly ANA Programmatic Transparency Benchmark at no charge? Starting with the second quarter results next month, TAG members will get complimentary access to those results as part of their TAG member benefits! 

Launched in early 2024 in partnership with global cross-industry initiative TAG TrustNet, the ANA Programmatic Transparency Benchmark helps companies collect, reconcile, and analyze proprietary log-level data to establish supply chain metrics against which they can regularly assess their own programmatic campaigns. 

Currently, Benchmark is collecting, reconciling, and analyzing log-level data (LLD) for dozens of major brands, and the ANA released topline findings from the Q1 results in May. The Q2 results will include a continuing analysis of trends over time and detailed breakdowns by environment (CTV, web, mobile in-app) as well as marketplace type (OMP/PMP).

The Q2 findings will be made available to view through on an online platform that can be accessed by TAG members. To access those results, TAG members can complete the form below to receive log-in credentials from measurement partner Fiducia:

For more information about the Programmatic Transparency Benchmark or the TAG Certified for Transparency Program, please contact info@tagtoday.net. 

---

TAG’s Lisa Gansky Shares ABCs of PMAL 

The wide range of tools offered by TAG (and acronyms used to describe them) can sometimes seem a little overwhelming, so Lisa Gansky, TAG’s Director of Product Management, has created a simple explainer on LinkedIn for TAG’s Pirate Mobile App List (PMAL), a critical tool in the fight against the criminals who steal content and deliver ads to monetize it.

An excerpt from that piece follows:

You might think the battle ends once a [pirate mobile] app is pulled from the Apple App Store or Google Play for copyright violations. But you’d be wrong. 

Many of these apps, streaming pirated music, movies, TV shows, games, and even cracked software, don’t just disappear. They live on, in third-party app stores, unofficial APK repositories, or remain installed on millions of devices, still raking in ad revenue. And unless you’re working to block pirate apps across that ecosystem, your brand could be funding them.

That’s where another TAG tool comes in: the Pirate Mobile App List (PMAL).

PMAL is a quarterly-updated, TAG-member-contributed tool that helps brands and their partners avoid serving ads on mobile apps that distribute pirated content.

Whether the app is gone from Google or Apple stores, or still lingering in third-party shadows, PMAL helps ad buyers and brand safety teams steer their ad dollars away from these illicit channels. …

Removal from an app store doesn’t guarantee removal from distribution or continued use on devices where the app is installed. Rogue and third-party app stores often include pirate apps. And some can reappear on legitimate app stores under slightly modified names or developers. …

We’re calling on mobile piracy experts within TAG member companies to contribute to PMAL. If your team monitors infringing apps and receives confirmations from app stores about takedowns, you can help lead the charge.

---

State of the Fight returns for its 10th year!

Join us this October in New York City for a one-of-a-kind TAG Community event packed with:

• Bold conversations
• Spicy takes
• Thought-provoking agenda tackling digital advertising’s biggest challenges. 

This exclusive gathering is a must-attend for anyone shaping the future of adtech.

🔥 Seats are limited—reserve yours now and be part of the action at the hottest event this October!

 

 

From “Inside the Political Reckoning Shaking Up the Ad Industry” in Business Insider:

The practice of brand safety arose as advertisers shifted from analog media buying — placing deals directly with the TV stations, billboard owners, or newspaper proprietors they wished to buy space with — toward digital. …

Keyword block lists were an early but somewhat blunt tool, helping advertisers avoid appearing in articles about grisly news topics like murders or natural disasters. However, marketers often didn't maintain good block list hygiene.

Mike Zaneis, CEO of ad industry accreditation organization the Trustworthy Accountability Group, said he was recently reviewing brand block lists that still had the term "Ariana Grande" on them, years after the deadly terrorist attack that took place at the pop star's Manchester Arena, UK, concert in 2017.

"Never mind that she's won two Grammys since then," Zaneis said.

 

From “AI Tools Help Vodafone Reduce Blocking Rates on News Sites” in WARC:

Hard news attracts audiences to news publishers’ sites, but all too often the ad dollars one might expect to follow don’t materialise. That’s because many advertisers continue to use crude keyword blocklists to avoid appearing next to content – natural disasters, murders, armed conflicts – they feel might reflect poorly on their brands.

And those blocklists may be infrequently reviewed, leading to situations such as that described to Business Insider by Mike Zaneis, CEO of the Trustworthy Accountability Group. 

Zaneis recently reviewed brand block lists that still contained the term “Ariana Grande” long after the event that led to the pop star being listed in this way – a terrorist attack at her 2017 Manchester concert. “Never mind that she’s won two Grammys since then,” he said.

 

From “Escalated.io Becomes Qualified Data Contributor to TAG’s Data Center IP List” in TalkCMO:

Escalated.io, a company specializing in ad fraud detection that identifies various forms of invalid traffic online, has declared that it is now a Qualified Data Contributor (QDC) to TAG's Data Center IP (DCIP) roster. Managed by the Trustworthy Accountability Group (TAG), a global certification initiative aimed at enhancing safety and transparency in digital advertising, the DCIP roster consists of IP addresses recognized for their high risk of either generating or originating invalid traffic (IVT).

This resource can be utilized by businesses throughout the advertising supply chain to evaluate transactions and effectively filter out these IP addresses. The list is created in partnership with qualified organizations that assist in gathering and assessing relevant IP addresses, and it is published by TAG on a monthly basis.

---

 

Team TAG are always looking to connect with the TAG Community wherever they are! 

In the coming months, you can find us at:

If you're going to be there and want to connect with us over a beverage, then reach out to us below!

---

Keep Up-To-Date With The Working Group Brief

TAG's working groups are a crucial source point of conversation and collaboration for digital advertising. Make sure you stay up to date with the latest progress and developments with the Workin Group Brief. 

Read the latest Working Group Brief 👉 tagtoday.net/working-groups

Leverage TAG Research into Your Everyday!

From APAC Fraud Snapshot reports, to UK Brand Safety Consumer reports, to Best Practices whitepapers, TAG's research is here to support our member's day-to-day compliance as well as strategic planning. 

Visit our Data and Insight page 👉 tagtoday.net/insights

Let's Make Some Noise Together 🤝

We love it when TAG members highlight our work together to fight digital ad crime and improve transparency. Please send any TAG-related press releases, blogs, or other announcements to Andrew Weinstein at andrewwstn@gmail.com for review before release.

 

Topics: Blog