Teams
One Platform That Fits the Way Your Team Operates.
A use case describes a job. A team shape describes everything around it: how many organizations you answer for, where a finding goes next, and whether you work from a queue, a client roster or a country.
The shapes below come up most often. All of them run on Deepinfo’s modules and index, each with a different center of gravity.
-
- Answers for
- One organization
- Starts from
- An indicator in an alert
-
- Answers for
- A roster of client organizations
- Starts from
- A new client’s primary domain
-
- Answers for
- The institutions of a country
- Starts from
- A sector list or a country code
-
- Answers for
- The board and the business
- Starts from
- A board question about exposure
-
- Answers for
- A product built on the data
- Starts from
- The index, through API services and feeds
One index, one API api.deepinfo.com/one apikey header
- 400M+ domains
- 2B+ subdomains
- 200B+ DNS records
- 30B+ SSL certificates
Find the Shape Closest to Yours.
Each shape leans on different modules of the Deepinfo Platform: External Attack Surface Management, Cyber Threat Intelligence, Brand Risk Protection, Third-Party Risk Management and Deep Search & Insights.
SOC Teams
External findings for an internal queue. Exposed assets, leaked credentials and lookalike domains arrive as records with states, and the API enriches any indicator during triage.
MSSPs
Many client surfaces, one engine. Each client gets the full discovery, scanning and scoring, and the API carries onboarding, bulk decisions and scheduled reports.
National CERTs
Questions at the scale of a country. Constituents sit on portfolios with one score, Domain Search and bulk feeds reach across the whole index, and threat actors can be filtered by the countries they target.
Security Leaders
Answers for the board. A security score with its trend, reports from the executive summary down, vendors on the scale of your own surface and fixes counted only when a rescan confirms them.
Security Vendors
Data for a product. Ratings, attack surface and threat intelligence vendors take the index through API services and feeds, and spend their engineering on the product instead of the collection.
Where Each Team Starts and Ends.
One platform, read by different teams. The differences are in scope and in where the work goes next, not in the data.
| SOC teams | MSSPs | National CERTs | Security leaders | |
|---|---|---|---|---|
| Answers for | One organization | A roster of client organizations | The institutions of a country | The board and the business |
| Usual starting point | An indicator in an alert | A new client’s primary domain | A sector list or a country code | A board question about exposure |
| Works from | A queue of findings with states | One engine, client by client | Portfolios and the index itself | Scores, trends and reports |
| Modules used most | CTI, DSI, EASM | EASM, TPRM, BRP | DSI, CTI, BRP, TPRM | EASM, TPRM, CTI |
| API used for | Enrichment and bulk decisions | Onboarding, exports and reports | Country-wide queries and bulk files | Reports into existing dashboards |
| What the team produces | Closed tickets, verified fixes | Client reports on a schedule | Sector warnings and takedown evidence | Board reporting and vendor decisions |
One Index and One API Under Every Team.
A SOC analyst enriching an IP address, an MSSP onboarding a client and a CERT analyst querying a country code all call one base URL, authenticate with the apikey header and read the same index.
Findings look alike wherever they surface: identical data layers per asset, CVEs ranked by CVSS, EPSS and CISA KEV, and one set of issue states. A score means the same thing from one team to the next.
- Base URL
api.deepinfo.com/v1 - Auth
- One
apikeyheader - Endpoints
- Grouped by module
- Bulk actions
- Driven by filters
Questions About Deepinfo for Security Teams
Our team does not match any of these shapes. Does the platform still fit?
Usually. The shapes are common patterns, and the modules, index and API underneath them are shared. Describe how you operate and we will say plainly whether the platform fits.
Can one organization combine shapes?
Often it does. A bank’s SOC can work the findings queue while its group security team follows subsidiaries as portfolios, and both read the same scores.
Can a team use only the API and the data?
Yes. Deepinfo API Services and Data Feeds are sold on their own, for teams that run their own tooling. They deliver the index the platform runs on, as endpoints and bulk files.
How does a team get API access?
Keys are created in the platform under Settings, Organization Settings, API Keys, and sent in an apikey header. If your team has no platform access yet, talk to us and we set it up for your plan. Which endpoints a key can call, and its rate limits, depend on that plan.
Tell Us How You Operate. We’ll Map It.
Describe your team’s shape on a short call and we’ll show the parts of the platform that fit it, on your domains.