Exposure Intelligence
Exposure and attack-surface analysis, investigations and monitoring
We find what can be seen of you from outside, such as exposed assets, leaked information and impersonation, and tell you whether it really concerns you and what to do first.
We analyse exposed assets and accounts, leaked material and impersonation together with their history and relationships, and record where and when each came from.
What can be seen from outside, and which threats are relevant?
We set out the evidence, what has changed, and what to check and act on first.
Reviewed
What we analyse
Exposure and attack-surface analysis is at the core, combined with relevant threat information. What the first three find also feeds the TLPT Threat & Scenario Analysis.
What of ours is open to the internet, and is any of it unknown to us?
We find what an attacker sees of you first from outside, such as domains, servers and admin screens, and set it out as a list of assets with evidence and priorities for action.
Is the information said to be out there real, and is it really ours?
We trace information about you that is out there, such as staff credentials or customer data, back to where it first appeared, and pick out what is still a risk today.
What is behind the sites and texts impersonating us, and how far have they spread?
We follow the infrastructure behind impersonation that has surfaced to find cases not yet reported, and also look at what to improve on your side.
Which attackers and scenarios should our TLPT be based on?
We analyse your attack surface, exposed information and the relevant threat actors and methods, and develop them into TLPT attack scenarios that fit your environment.
What is visible from outside is where checking starts. Whether it is yours, whether a vulnerability is present, whether it can actually be exploited and whether a breach has happened are judged one by one, and we state sources and timing, with what is confirmed kept apart from what is inferred.
To confirm whether exposed servers or admin screens can actually be exploited: Vulnerability Assessment & Penetration Testing (VAPT)
How it runs
Depending on your goal, choose a fixed-term assessment, an in-depth investigation of one matter, or monitoring that watches for changes at a set interval, or combine them.
- Exposure AssessmentWhat is exposed, at one point in time
We take a wide look, at one point in time, at your exposed assets, services and accounts and at leaks and impersonation, and set out the evidence, possible impact and priorities for action.
- Threat InvestigationOne matter, followed in depth
We analyse in depth how a reported leak or impersonation, or a specific attack infrastructure or campaign, connects to others and what history lies behind it, keeping confirmed facts, assumptions and the limits of the information apart.
- Exposure MonitoringChanges, at an agreed interval
We set what to watch and the alert criteria with you in advance, then check for changes at regular intervals and let you know what we find.
It suits organisations that often open new domains and services, or where impersonation keeps recurring.
To keep this analysis going through the year with security advice alongside, make it part of Cybersecurity Care.