Use cases
Six situations, from signal to decision
What external monitoring actually produces: what triggers the alert, what we do, what you get. Six illustrative scenarios, no client case study. What external monitoring actually produces: what triggers the alert, what we do, and what you get at the end. These six situations are illustrative scenarios, we publish no client case studies, not even anonymised ones.
In one sentence
A VesperID use case describes, on an illustrative scenario, what triggers an alert, what the platform and the analyst then do, and what you get at the end: a documented decision rather than one more notification.
A scenario written to explain a mechanism: it describes no client.
Each of these situations is an illustrative scenario built from publicly documented mechanisms. None describes a VesperID client, and no outcome is presented as guaranteed: they are typical sequences, not performance promises.
- 01Illustrative scenarioOrganisation perimeter
A work password reused on a third-party service
The situation
An online booking platform is compromised and its user base is circulated. Among the addresses are around fifteen accounts on a company’s domain, two of them belonging to system administrators. Nothing signals it on the company’s side: none of its systems is involved.
What we do
Monitoring ties each address to an identity in the perimeter, removes duplicates against older exposures, and raises the severity for the two privileged accounts, known as such from the declared perimeter. The platform carries the source, its date and whether a password was actually present in the alert, sent according to the organisation’s rules.
What you get
A single alert, listing the identities involved in priority order, with a targeted reset recommendation. The team handles fifteen accounts rather than launching a company-wide campaign, and the two privileged accesses are reset first. In the exposed-staff analysis, the two administration accounts enter the “access to harden” cohort and the thirteen others “awareness recommended”, with the export for the security team, which organises the session.
- 02Illustrative scenarioOrganisation perimeter
A phishing campaign in preparation
The situation
A domain reusing a company’s name with a doubled character is registered. No page is published, no email is sent: at this stage nothing would be detected by a mail gateway or a web filter.
What we do
The domain is detected at registration and placed under observation. Two days later a mail record appears, then a certificate covering a subdomain suggesting a customer portal: severity rises to critical and an analyst validates the case.
What you get
The alert goes out before the first send. The domain is blocked on the mail gateway and the proxy the same day, a takedown request is filed with the registrar, and the evidence file stays available if legal follow-up is needed.
- 03Illustrative scenarioOrganisation perimeter
A provider published on a leak site
The situation
A payroll provider is claimed by a ransomware group. The announcement names none of its customers, and the provider has not yet communicated with anyone.
What we do
The provider’s name is among the monitored keywords declared during scoping. The match is verified by an analyst to rule out a namesake, then linked to the company’s supplier record, which states the nature of the data entrusted to them.
What you get
The company is alerted before any public communication from the provider. It has several days to confirm the scope with them, freeze automated exchanges and prepare communication to its employees and, where required, notification to the authority.
- 04Illustrative scenarioOrganisation perimeter
A sales manager’s personal laptop is infected
The situation
A sales manager occasionally opens their work mail from a personal computer. That machine runs an information stealer downloaded along with a free utility. It is not part of the company fleet and reports into no detection tool.
What we do
The log produced by the stealer is detected because it contains access tied to the monitored domain. The machine is treated as a single incident: affected work access, session cookies still valid, associated personal accounts. The exposure chain links the device, the captured credentials and the still-valid session to the mailbox it opens, with the “infected workstation” origin and the isolation playbook.
What you get
An alert listing exactly which access to revoke and which sessions to invalidate, with a playbook. The company cuts access without waiting to act on a machine it does not own, and the sales manager is informed with a factual message.
- 05Illustrative scenarioPersonal perimeter
An executive impersonated on a professional network
The situation
A fake profile reuses an executive’s name, photograph and career history, then contacts members of her teams to arrange a “confidential conversation”. The profile is convincing: the details come from public sources and an old leak.
What we do
The profile is detected through monitoring of the personal record, opened once the executive accepted the invitation herself. An analyst documents the fake profile, the reported messages and its history, then prepares the takedown request to the platform.
What you get
The request is filed with a complete file, and the executive receives a warning message to circulate to her teams. The timestamped evidence file stays available to her counsel if she chooses to file a complaint.
- 06Illustrative scenarioOrganisation perimeter
An acquisition brings an unknown surface
The situation
An industrial group integrates a company acquired eighteen months earlier. The inventory provided during the transaction listed four domains and one address range. The observed reality holds more, including a staging environment still reachable.
What we do
The declared domains and ranges are verified then observed from the outside. An administration service answers on one of the subsidiary’s addresses and advertises an old version; no exploitation testing is performed. In parallel, two of the subsidiary’s addresses appear in infected-machine logs.
What you get
A real external inventory, comparable with the transaction document, and two immediate actions: closing the maintenance access left open by an integrator, and targeted resets on the affected accounts. An investigation note documents the gap for the risk function.
Request an exposure assessment.
One hour with an analyst, not a demo: what already circulates about your organisation, what to monitor, what is better left alone. Reply within one working day.
No public price list: bespoke offering, written proposal after scoping.