Methodology
Five phases, one rule: send only what supports a decision.
External monitoring is worth what it can explain: where the information comes from, how it was qualified, what it does not say. Here is how we work, phase by phase. External monitoring is worth what it can explain: where the information comes from, how it was qualified, what it does not say. Here is how we work, phase by phase, and what we refuse to do.
We invent no threats and we do not test your defences. We observe what already exists outside your organisation, match it against your perimeter, qualify it, then hand it over in a form that supports a decision. The rest, theatre, comparison scores, alerts without an action, harms our clients’ work.
Phase 01
Scoping
A structured conversation: your business, your perceived exposure, past incidents, what is already monitored and by whom, who must be alerted and from what severity. Mostly we look for what should not be monitored: an overly wide perimeter produces noise, and noise always ends up ignored. At the end of the conversation we say whether we think we are useful, including when we are not.
- A proposed perimeter, asset by asset, including what we recommend leaving out
- A service selection justified by your actual exposure
- A written, itemised proposal, with no commitment
Who is involved · A VesperID analyst, and on your side the person responsible for security, joined where useful by legal counsel or compliance.
What you get: a perimeter proposed line by line, including what we recommend not monitoring.
Phase 02
Perimeter and verification
You declare your assets in your client area: domains, subdomains, addresses, people, keywords, address ranges, code repositories, Microsoft 365 tenant, bank identification numbers. Every domain must be verified by publishing a DNS record before it is monitored. A person is monitored by name only after accepting the invitation themselves; without that acceptance, the organisation monitors only the work accounts it controls, after informing its staff. Some collection services require your identifiers to be submitted to our collection provider: that point is subject to information and to a recorded attestation, explained before activation. The client area installs on desktop and on mobile from the browser; the same account and the same rights follow you from one device to the next.
- A verified perimeter, asset by asset, with the date and method of verification
- The acceptances of the people monitored and the organisation’s attestation for external collection, recorded
- Initial alerting rules: channels, recipients, minimum severity
Who is involved · The account owner on the client side, with an analyst’s support; the individual themselves for any personal profile.
What you get: assets verified through DNS, never an agent, and the available history from the first verification.
Phase 03
Collection and correlation
The platform collects continuously from the sources attached to your verified assets, and pulls in the available history from the first synchronisation. Items are normalised, deduplicated and linked: the same person appearing in a leak, in an infected-machine log and in a stolen session is one incident, not three alerts. Secrets are discarded at ingestion: neither the value of a password, nor the hash supplied by the source, nor the value of a cookie is written to our database; for a mention, only a short, masked excerpt of the publication is kept.
- An inbox of detections that are dated, sourced and attached to your assets
- An exposure score and its time series, comparable to themselves over time
- Links between detections that belong to the same incident
Who is involved · The platform, automatically. No human intervention is required at this stage, and no analyst opens a client’s data without a reason.
- Network infiltration Collection partners
- Leak acquisition Collection partners
- Open web and dark web Continuous collection
- Alerts
- Client area
- Monthly report
What you get: three collection channels tied to your perimeter, correlated and scored by the platform.
Phase 04
Qualification and alerting
Every detection receives a severity based on the freshness of the information, the nature of the exposed data and the criticality of the asset involved, and the expected action its playbook names. The alert then goes automatically to the channels you configured, respecting the minimum severity and the quiet hours you set. An analyst qualifies a case at your request, through a ticket, and stays reachable on the ones that make you doubt.
- Qualified alerts, with the asset involved, the source, the date and the expected action
- Periodic digests for non-critical detections, to limit interruptions
- A complete delivery history, with recipient and delivery status
Who is involved · The platform, automatically, according to your rules; a VesperID analyst at your request.
What you get: a finding that is dated, scored, carries the expected action, and is sent to the channels you chose.
Phase 05
Response and reporting
From a detection, you launch what is needed: a takedown request, a deeper investigation, an export to your tools, assignment to a team member. The monthly report consolidates the period, and a periodic review with your analyst lets you adjust the perimeter, the rules and the priorities. What did not work is stated explicitly: a refused takedown request appears in the report just like a success.
- A monthly report ready for leadership, and on-demand reports for your audits
- Tracking of takedown requests and investigations, with their real outcome
- A perimeter and rules adjusted at every review
Who is involved · Your teams for internal remediation, our analysts for takedowns and investigations, and a shared periodic review.
What you get: a dated posture report your leadership and your auditor can read.
Five non-negotiable principles
These rules drive our product and commercial decisions. They are written here because you should be able to hold us to them.
- 01
Source it, never manufacture it
Every piece of information displayed comes from a dated, attributable observation. We do not manufacture hypothetical threats, we do not extrapolate risk from a sector, and we publish no figure we could not source publicly. When we do not know, the interface says so.
- 02
Alert in order to act
A notification that does not say what to do should not be sent. Every alert states the asset involved, the source, the freshness and the expected action. If we have no action to recommend, the item goes into a periodic digest rather than to your phone.
- 03
Analysts, not only rules
The platform alone decides what goes out as an alert, according to your rules, and says so. Our analysts step in where a rule is not enough: scoping, qualifying a case at your request, investigations, takedowns, reports and the periodic review of your perimeter.
- 04
Sovereignty and transparency
VesperID is a French cybersecurity company: its platform is built and operated by its own teams, and the contract falls under French and European law. Where collection relies on our provider established in Canada, the transfer rests on an adequacy decision supplemented by standard contractual clauses, and it is described in our privacy policy, without evasive wording.
- 05
Minimal retention
We never keep the value of a password, the hash supplied by the source, the value of a session cookie or a full card number. We keep metadata (the account concerned, the source, dates, hash type, the length of a cleartext password, counters) and, for mentions, a short, masked excerpt of the publication, for written and limited periods. What we do not keep cannot leak from our databases or be resold; we answer legal requests only under the conditions provided by law.
What automation does not do
Automation is essential for volume: nobody can manually read every event touching a corporate perimeter. But it cannot tell you that a claim is probably false, that a domain actually belongs to a partner, that an old exposure has become urgent again because a password never changed, or that an alert should go to someone other than the usual recipient. That is the analyst’s work, when you call on them about a case, in an investigation, a takedown or the periodic review, and it is why we do not sell the platform without them.
A question about the method?
We answer in detail, including about what we do not cover. Scoping is free and carries no commitment.
Bespoke offering: one price per service, no public price, no packages.