# Teams

URL: https://www.deepinfo.com/audience/

## One Platform That Fits the Way Your Team Operates.

A use case describes a job. A team shape describes everything around it: how many organizations you answer for, where a finding goes next, and whether you work from a queue, a client roster or a country.

The shapes below come up most often. All of them run on Deepinfo’s modules and index, each with a different center of gravity.

[Request demo](https://www.deepinfo.com/request-demo/) · [Talk to us](https://www.deepinfo.com/contact/)

### Find the Shape Closest to Yours.

Each shape leans on different modules of the Deepinfo Platform: External Attack Surface Management, Cyber Threat Intelligence, Brand Risk Protection, Third-Party Risk Management and Deep Search & Insights.

#### [SOC Teams](https://www.deepinfo.com/audience/soc-teams/)

External findings for an internal queue. Exposed assets, leaked credentials and lookalike domains arrive as records with states, and the API enriches any indicator during triage.

#### [MSSPs](https://www.deepinfo.com/audience/mssps/)

Many client surfaces, one engine. Each client gets the full discovery, scanning and scoring, and the API carries onboarding, bulk decisions and scheduled reports.

#### [National CERTs](https://www.deepinfo.com/audience/national-certs/)

Questions at the scale of a country. Constituents sit on portfolios with one score, Domain Search and bulk feeds reach across the whole index, and threat actors can be filtered by the countries they target.

#### [Security Leaders](https://www.deepinfo.com/audience/security-leaders/)

Answers for the board. A security score with its trend, reports from the executive summary down, vendors on the scale of your own surface and fixes counted only when a rescan confirms them.

#### [Security Vendors](https://www.deepinfo.com/audience/security-vendors/)

Data for a product. Ratings, attack surface and threat intelligence vendors take the index through API services and feeds, and spend their engineering on the product instead of the collection.

### Where Each Team Starts and Ends.

One platform, read by different teams. The differences are in scope and in where the work goes next, not in the data.

|  | SOC teams | MSSPs | National CERTs | Security leaders |
| --- | --- | --- | --- | --- |
| Answers for | One organization | A roster of client organizations | The institutions of a country | The board and the business |
| Usual starting point | An indicator in an alert | A new client’s primary domain | A sector list or a country code | A board question about exposure |
| Works from | A queue of findings with states | One engine, client by client | Portfolios and the index itself | Scores, trends and reports |
| Modules used most | CTI, DSI, EASM | EASM, TPRM, BRP | DSI, CTI, BRP, TPRM | EASM, TPRM, CTI |
| API used for | Enrichment and bulk decisions | Onboarding, exports and reports | Country-wide queries and bulk files | Reports into existing dashboards |
| What the team produces | Closed tickets, verified fixes | Client reports on a schedule | Sector warnings and takedown evidence | Board reporting and vendor decisions |

### One Index and One API Under Every Team.

A SOC analyst enriching an IP address, an MSSP onboarding a client and a CERT analyst querying a country code all call one base URL, authenticate with the `apikey` header and read the same index.

Findings look alike wherever they surface: identical data layers per asset, CVEs ranked by CVSS, EPSS and CISA KEV, and one set of issue states. A score means the same thing from one team to the next.

[API reference](https://docs.deepinfo.com/reference/)

- **Base URL**: `api.deepinfo.com/v1`
- **Auth**: One `apikey` header
- **Endpoints**: Grouped by module
- **Bulk actions**: Driven by filters

### Start From a Workflow or a Sector.

- [Use cases](https://www.deepinfo.com/solutions/use-cases/) (Solutions): Workflows from attack surface management to threat hunting.
- [Industries](https://www.deepinfo.com/solutions/industries/) (Solutions): Sectors, and where exposure concentrates in each.
- [Partners](https://www.deepinfo.com/partners/) (Company): For service providers who deliver the platform to their clients.

### Questions About Deepinfo for Security Teams

**Our team does not match any of these shapes. Does the platform still fit?**

Usually. The shapes are common patterns, and the modules, index and API underneath them are shared. Describe how you operate and we will say plainly whether the platform fits.

**Can one organization combine shapes?**

Often it does. A bank’s SOC can work the findings queue while its group security team follows subsidiaries as portfolios, and both read the same scores.

**Can a team use only the API and the data?**

Yes. Deepinfo API Services and Data Feeds are sold on their own, for teams that run their own tooling. They deliver the index the platform runs on, as endpoints and bulk files.

**How does a team get API access?**

Keys are created in the platform under Settings, Organization Settings, API Keys, and sent in an `apikey` header. If your team has no platform access yet, [talk to us](https://www.deepinfo.com/contact/) and we set it up for your plan. Which endpoints a key can call, and its rate limits, depend on that plan.

**We deliver security services to clients. Is there a partner program?**

Yes. Resellers, managed-service partners and technology partners each have a partner type. See [Partners](https://www.deepinfo.com/partners/), or read how [MSSPs](https://www.deepinfo.com/audience/mssps/) run client surfaces on the platform.

### Tell Us How You Operate. We’ll Map It.

Describe your team’s shape on a short call and we’ll show the parts of the platform that fit it, on your domains.

[Request demo](https://www.deepinfo.com/request-demo/) [Talk to us](https://www.deepinfo.com/contact/)