Defensive only. This playbook runs passive collectors (HIBP, lookalikes, breach corpora) on assets you are authorized to monitor. No marketplace access.