Employee credentials in a stealer log
An infostealer on an employee's personal device exfiltrated credentials and an active session cookie for the corporate VPN portal. The record surfaced inside a bulk sale package on …
4 modules
See what the attacker sees.
InsightGuard continuously scans your externally visible footprint: leaked credentials, lookalike domains, exposed ports and every dark web mention of your brand. It separates signal from noise and turns it into a case.
Representative signal feed
02Trusted by
03 How it works
Read the relationship, see the attack first.
Cyber telemetry and international-relations data are fused into one picture: at which level of tension, which group targets what.
-
Collect the signals
Two layers are watched at once. On the cyber side: actor activity, campaigns, leaks, infrastructure moves. On the diplomatic side: sanctions decisions, voting blocs, official statements and rhetoric volume.
-
Decode the relationship
The relationship between two countries is reduced to an index. For each band of that index, the platform maps which actor groups activated in the past and which sectors they targeted. What gets linked is a pattern, not an event.
-
Forecast and advise
The likely next target and technique are derived and intersected with your exposure. The output is not an alert but a ranked list of measures, each with an owner and a deadline.
04 Product map
Seven disciplines, one case backbone
Each column is a menu group in the product, each tile a module with its own screen. Wherever a finding originates, it lands in the same case format — with an owner, a severity and a closing reason.
IG-MAP
27 modules, one case backbone
Hover over or focus a module to read what it does here.
05 Modules
One platform, distinct disciplines
Modules
-
Operations Center
Every module's findings land in a single case format. The team prioritises from the command screen, owns each case and automates repeat work with playbooks.
Explore module -
Attack Surface Management
Every externally visible asset, from domains to VIP staff, is inventoried, scanned and given a 0–100 risk score and a letter grade. What is exposed, how risky it is and what changed this week — on one screen.
Explore module -
Brand Protection
Domains, social profiles, ads and mobile apps impersonating your brand are watched across four channels; each finding is scored, classified by AI and tied to a takedown request.
Explore module -
Dark Web Monitoring
Posts from forums, marketplaces and closed channels are archived, and those targeting you, your sector or your country are separated out. The actor behind them — profile, techniques, history — sits in the same place.
Explore module -
Threat Feed
Scored IP, domain, URL and hash indicators are listed with context; filtered lists flow to your firewall and SIEM, and hunting rules land in your SOC tools in eight formats.
Explore module -
Global Threat Landscape
Ransomware leak sites, stealer log markets, the CVE stream, leak databases and security news are scored against your organisation. When an outside threat meets inside exposure, it becomes a case.
- Ransomware Telemetry
- Underground Economy
- Vulnerability Intelligence
- Compromised Assets
- Intelligence Wire
06 Anatomy of a case
From a fake domain to a closed case
Follow what happens in the platform from the moment a phishing domain gets its certificate to the moment the case closes. A representative flow — timings depend on your playbook and integration settings.
-
T+00:00 Tespit
A new entry in the certificate log
A TLS certificate is issued for brand-login[.]com. The domain is a typo match for the organisation's root domain, so it lands on the watch list.
ct brand-login.com issuer=R11 match typo(brand.com) +login
Phishing Monitoring -
T+00:03 Zenginleştirme
Weaponisation check
DNS resolves, there is an MX record and the page returns HTTP 200. A screenshot is taken: a pixel-perfect copy of the organisation's login page.
dns A 203.0.113.41 ✓ mx mail.brand-login.com ✓ http 200 /login screenshot saved
Phishing Monitoring -
T+00:04 Zenginleştirme
Score and AI classification
Four signals become a score: 94. The AI classifies the page as phishing with 96% confidence.
score 94 (+4) ai phishing 0.96
Phishing Monitoring -
T+00:05 Case
A playbook opens the case
The "Phishing — new look-alike domain" playbook matches and opens a high-priority case, tagged Phishing and Brand Abuse and assigned to the SOC team.
playbook phishing.lookalike ✓ case #TK-BA10B HIGH → soc-operations
Case Manager -
T+00:06 Action
It joins the block list
The domain and IP are added to the "critical indicators" list. The mail gateway and DNS filter that pull the list block the domain on their next sync.
ioc_list critical-indicators +2 notify slack #soc ✓
IoC Lists -
T+00:09 Action
Takedown request
The automatic takedown playbook opens the request; screenshot, DNS records, certificate and registrar details are added to the evidence pack.
takedown requested registrar=NameSilo evidence 4 files attached
Takedown Management -
T+∞ Kapanış
Closed with a reason
Once the domain is suspended, the case closes as "resolved". New variants from the same source later attach to this case.
takedown completed case #TK-BA10B resolved
Cases
07 Product
The command screen
Every module shares one case backbone. Wherever a finding originates, it is owned and closed in the same flow.
Screenshots are taken from a demo tenant; organisation names and data are entirely fictional.
08By the numbers
0+
Platform modules and screens
One interface from dark web to IOC feeds
0/24
Continuous collection
Scanning and monitoring never clock off
0
Agents to install
The platform works entirely from outside
≤0 h
First full scan
Including the retrospective leak sweep
09 By team
Same data, four different jobs
From the board report to downloading detection rules, everyone works on the same platform, on their own screen.
The answer to the board's "how exposed are we from the outside?" on one screen: risk score, open critical cases and campaigns targeting your sector.
- The Executive Summary tab replaces the weekly report
- How exposure changed over 30 days is visible per asset
- An early warning when a ransomware victim appears in your sector
Cases with context, step-by-step remediation and one search across every module. Triage starts by reading the case, not gathering data tab by tab.
- Every case carries a description and numbered remediation
- Search an IP or hash across seventeen sources with Global Discovery
- Quick checks, from WHOIS to hash reputation, in the SOC Armory
Evidence-ready findings for fake domains, impersonating profiles and ads, with a trackable takedown process. You act before the complaints arrive.
- Every finding carries screenshot, DNS, certificate and registrar
- Takedown status is tracked with the case
- Fake profiles in executives' names are caught by VIP monitoring
Which version runs on which server, and which one matches a known flaw? Patch order follows real exposure, not just CVSS.
- Technology versions are mapped to CVEs and CVSS
- Orphaned subdomains and expiring certificates show up in advance
- Critical IP lists reach the firewall through the API
15 FAQ
Frequently asked
Cyber threat intelligence is data about attacks and attackers targeting your organisation, analysed until it is actionable. InsightGuard does this from the outside: it finds leaked credentials, look-alike domains, exposed services and dark web mentions of your name, and turns them into cases. See our cyber threat intelligence guide for the full picture.
Open sources (certificate transparency logs, passive DNS, WHOIS, internet scan data), closed sources (dark web forums, marketplaces, Telegram channels, ransomware leak sites) and commercial feed partners. The source list is shared as a contract annex.
Defining your domains and keywords takes one business day. The first full scan and the retrospective leak sweep typically complete within 24–72 hours. No agent installation is required; the platform works entirely from outside.
Each organisation's data is segregated per tenant; one organisation's findings are never used in another's analysis. Hosting location, retention periods and the deletion procedure are set out in writing in the contract. The Enterprise package offers a single-tenant deployment option.
Every finding attaches to a case and can be closed as a false positive. The closure rationale is recorded and the same record will not alert again. Risk acceptance is a separate closure type with an expiry.
IOCs and cases can be pushed to SIEM, SOAR and ticketing systems. The current list is on the Integrations page; for anything not listed, a REST API and webhooks are available.
Three layers work together. Every asset has a 0–100 risk score and an A–F grade; every finding gets a critical, high, medium or low severity; phishing pages are additionally classified by AI. Playbooks in the Case Manager set thresholds on these fields: for example, a CVSS 9.0+ vulnerability matching a monitored asset opens a critical case automatically.
Users are grouped into teams and permissions are granted to teams, not individuals. SOC, brand protection, attack surface and threat intelligence teams can see only their own modules; the company admin role is separate. Two-factor authentication can be enforced per tenant.
Cases, IoC lists, IP feed lists and hunting rules can be read and written through the REST API. Endpoints are documented with an OpenAPI schema; keys expire and carry only the permissions you choose (e.g. cases:read, ioc_lists:write).
Packages are sized by monitored domain families, module scope and seats. With an annual contract you pay for ten months instead of twelve. Listed prices are entry level; the final price comes in a written quote after the demo session. See the pricing page for details.
IG-CTA
Let's map your external exposure together.
In a 30-minute session we run a live scan against your own domains.