Identity & access
Infected devices
We identify the computers and phones, personal ones included, on which an information stealer captured sessions or credentials tied to your organisation. Infected-device detection identifies the computers and phones on which an information stealer captured sessions or credentials tied to your organisation, personal devices included.
The problem
An information stealer silently copies a machine’s passwords, session cookies and saved forms, then sells them in batches. The personal computer of an employee opening the HR portal, a contractor’s laptop: every device that touched your services becomes a door, and your EDR cannot see it. The logs of those machines, acquired as soon as they circulate, are the only trace you can get of them.
Client area preview
What you see
Fictional data, for illustration only: no client, no real data.
What you get: this screen in your client area, refreshed at every synchronisation, with CSV and JSON export.
- 01
Each infected device with its infection date, its system and the number of captured accesses
- 02
The services of your organisation affected: email, VPN, SSO, business tools
- 03
The remediation playbook: accounts to reset, sessions to revoke, person to contact
How it works
Our answer in three steps
VesperID identifies the devices whose log mentions your services: machine type, infection date, captured access, cookies still valid. You know which accounts to close and which sessions to revoke, even when the machine is not yours.
- 01
Your declared domains and people serve as the filter; no agent is installed on any device.
- 02
Stealer logs are acquired by our partners as soon as they circulate; the platform matches them against your services and groups the captures by machine.
- 03
The platform groups the captures by machine, flags the services of your organisation affected (other services are only counted) and names the remediation playbook; an analyst qualifies a machine at your request.
Where this data comes from
Every device comes from an information-stealer log our partners acquire as soon as it circulates, completed by what analysts observe of the batches sold on marketplaces; VesperID groups the captures by machine and by service affected.
Our sources in detailCross analyses
What the platform computes on top
This service’s data is crossed with the others’: here are the analyses that come out of it, all visible in the client area.
Discover the platform- 01
Device criticality
A score from the corporate services touched, the loot captured and the user, with the infection timeline.
- 02
Exposure chain
Infected device, leaked credentials, valid session, SSO access: the chain shows what the infection enables and names the isolation playbook.
- 03
Device to protect
The employee concerned joins the “device to protect” cohort with a recommendation: reinstall the device and rotate the credentials.
What you receive
Infected devices
- 01
One alert per device, with the services affected
- 02
Per-machine view in the client area, history included
- 03
Remediation playbook ready to hand to support
- 04
Monthly follow-up of reinfections and handled devices
Frequently asked questions
The device is personal: what can you do?
Tell you what was captured from your services, so you close the accesses and revoke the sessions on the company side. Cleaning the machine is up to its owner; we provide the steps to pass on.
Do you see the stolen files?
We see the log’s metadata: machine, date, services, presence of cookies. Sensitive contents are neither stored nor shown by default.
How is this different from credential monitoring?
Compromised credentials come from third-party breaches or logs; here the unit is the machine, with everything it exposed, including sessions replayable without a password.
Request an exposure assessment.
One hour with an analyst, not a demo: what already circulates about your organisation, what to monitor, what is better left alone. Reply within one working day.
No public price list: bespoke offering, written proposal after scoping.