Why the attack surface inventory is always incomplete
An inventory is a process, not a spreadsheet. Any subdomain without a known owner eventually becomes nobody's asset.
Blog
Notes from the team
Short answers to questions we meet in the field: reading stealer logs, catching typosquats, managing IOCs, closing cases. Research, operations and product notes.
Measuring supplier risk from outside instead of by questionnaire
An annual supplier questionnaire starts ageing the moment the contract is signed. The externally visible surface can be measured continuously.
The hard part of choosing keywords for dark web monitoring
Searching the company name is the easiest and least productive method. Yield lives in terms that are specific and hard …
Dangling subdomains: the quietest exposure
When a DNS record outlives the resource behind it, someone else can claim the name. Nobody notices, because nothing breaks.
Solving alert fatigue with thresholds, not counts
Reducing alert volume is an outcome, not a goal. The goal is that every alert can be tied to a …
Product note: finding ownership and closure rationale
A finding without an owner never closes; without a closure rationale it reopens three months later. We made both mandatory …
Sanctions lists and supply chain intelligence
When a supplier's jurisdiction changes, so does its risk profile. That is a signal the security team should track too.
Certificate transparency: free and good enough
CT logs are the cheapest way to find assets outside your inventory. They are noisy, but the noise is manageable.
Product note: making a threat score explainable
The score is not the valuable part; the reason for it is. Every point needs a rationale you can show.