Guides
Understand your exposure before you monitor it
Practical guides written by our analysts, to decide without us: responding to compromised credentials, preparing for NIS2, checking an impersonated domain, scoping dark-web monitoring. Practical guides written by our analysts, to decide without us: responding to compromised credentials, preparing for NIS2, checking an impersonated domain, knowing what dark-web monitoring should look at.
Each guide takes about ten minutes and ends with the questions we get during scoping. None of them assumes you become a client.
- Guide Responding to compromised credentials: the seven steps Faced with compromised credentials, you qualify the leak, contain the access, look for reuse and origin, check whether it was already used, then notify and document.
- Guide How to check whether your domain is being impersonated To find out whether your domain is being impersonated, generate its plausible variants, look them up in domain registries and certificate logs, examine their DNS and content, then request the removal of those imitating your brand.
- Guide Dark-web monitoring: what to watch, and what to ignore Useful dark-web monitoring for a company looks at six things: its domains and addresses in leaks, its brands and keywords on forums and marketplaces, its executives, its suppliers on leak sites, its data and documents, and access to its systems being sold.
- Checklist NIS2 checklist: your external exposure in seven points The NIS2 directive expects essential and important entities to manage their risks, including those of their supply chain, and to notify significant incidents within 24 and then 72 hours: monitoring external exposure is one of the most direct ways to meet that.
- Comparison VesperID or doing it yourself: an honest comparison Monitoring your own external exposure is possible with public tools and analyst time; a managed service brings access to closed sources, continuity, analysts on request and takedown handling, at the cost of an annual subscription.
- Definition What is threat exposure management? Threat exposure management (TEM, or CTEM in its continuous form) consists of identifying at all times what an organisation exposes on the outside, qualifying what is genuinely exploitable and treating the exploitable first, as a complement to internal protection, never in its place.
- Definition What is a stealer log? A stealer log is the archive an information stealer produces on an infected machine: passwords saved in the browser, session cookies, forms, files and the system fingerprint, resold in batches on cybercriminal markets and exploitable until the accesses it holds have been revoked.
- Definition What is the external attack surface? The external attack surface is everything an organisation exposes on the internet that an attacker can reach without any account: hosts, ports, services, certificates, applications, subdomains and the assets of subsidiaries or contractors, including those the internal inventory ignores; managing it (EASM) means discovering, monitoring and reducing it continuously.
Request an exposure assessment.
One hour with an analyst, not a demo: what already circulates about your organisation, what to monitor, what is better left alone. Reply within one working day.
No public price list: bespoke offering, written proposal after scoping.