Exposure Intelligence
Exposure and attack-surface analysis, investigations and monitoring
We turn what is happening outside into evidence you can decide on.
We investigate externally visible assets, services, accounts and related threats, analysing their history, relationships and changes. We check source, timing and actual relevance to your assets, then explain what the risk means and what to check and act on first.
What can be seen from outside, and which threats are relevant?
We set out the evidence, what has changed, and what to check and act on first.
Reviewed
When it fits
- Someone is impersonating you
Impersonating sites or texts, or an email asking a partner to send money in your CEO's name, are already out there, and you want to know what infrastructure they connect to and how far they reach.
- You've heard about a leak
You've had a tip that staff credentials or customer data are out, or heard your name is being mentioned somewhere, and want to know first whether it is true and whether it concerns you.
- You don't know what can be seen from outside
You want to find domains or servers open without your knowledge, and set down your attack surface: how your organisation looks to an attacker from outside.
- You need to keep checking for change
You often open new domains and services, or impersonation keeps recurring, and want changes checked at an agreed interval.
Three parts
Exposure and attack-surface analysis is at the core, combined with relevant threat information. Depending on your goal, choose a fixed-term assessment, an in-depth investigation of a specific matter or observation at an agreed interval, or combine them. Every service can be contracted on its own or combined with others.
- Exposure AssessmentWhat is exposed, at one point in time
We investigate your externally visible attack surface, such as assets, services and accounts, along with signs of leaks and impersonation, and set out the evidence, possible impact and priorities for action.
- Threat InvestigationOne matter, followed in depth
We analyse how a specific signal, incident, attack infrastructure or campaign connects to others and what history lies behind it. We separate confirmed facts from assumptions and state the limits of the information.
- Exposure MonitoringChanges, at an agreed interval
We observe and review changes in agreed targets and sources at an agreed interval. The interval, alert criteria, analyst review and the scope of our advice on response are each agreed before we start.
How it runs
Agree targets and sources
We agree what to look into — organisation, brand, domains, IP addresses, services, accounts — the sources to use, and the assessment period or monitoring interval.
Collect and link
Technology developed in our Exposure Intelligence research gathers external observations and links them through their relationships and history.
Expert review
Analysts check timing, source and relevance to you, and separate confirmed facts from assumptions.
Report
We explain the evidence, what the risk means, and what to check and act on first. With monitoring, each agreed interval brings a summary of what changed, and a change that crosses the alert criteria is reported with an analyst's review.
Related research: Exposure Intelligence (INTEL) — We analyse the history and relationships of exposure and attack surfaces to support security work.
What you receive
The information observed and its evidence, what the risk means, and what to confirm and act on first.
Evidence and sources
The source and timing of each observation and its relevance to you, with the supporting evidence.
Facts kept apart from assumptions
Confirmed facts are separated from assumptions, and the limits of the information and what still needs checking are stated.
Priorities for checking and response
What to check or act on first, based on the likely impact.
An observed exposure is a reason to check, nothing more. Whether it belongs to you, whether a vulnerability is present, whether it can actually be exploited and whether a breach has happened are kept as separate questions, and we state sources, timing, and what is confirmed versus inferred.
To confirm whether exposed servers or admin screens can actually be exploited: About VAPT (Vulnerability Assessment & Penetration Testing)
To test your detection and response against scenarios built from threat intelligence: About Threat-Led Penetration Testing (TLPT)