# Security Leaders URL: https://www.deepinfo.com/audience/security-leaders/ ## Answer the Board With Evidence. The board asks how exposed the company is, whether it is getting better and which vendors put it at risk. The Deepinfo Platform answers each one from scans of what you and your vendors expose to the internet, with the issues and their evidence underneath. [Request demo](https://www.deepinfo.com/request-demo/) · [Trust & security](https://www.deepinfo.com/trust/) ### Three Questions the Board Keeps Asking. Each one has an answer in the platform that rests on scans, not on self-assessment. Exposure #### How Exposed Are We? A security score for each asset, each domain and the whole attack surface, with the issues behind it broken down by asset, type and category. [Risk Scoring](https://www.deepinfo.com/platform/easm/complete-risk-scoring/) Progress #### Are We Getting Better? The score’s trend over days, weeks and months, and fixes that count only once a rescan confirms the signal is gone. [Remediation](https://www.deepinfo.com/platform/easm/remediation-with-actionable-insights/) Vendors #### Which Vendors Put Us at Risk? Third parties scanned by the engine that scans your surface and scored on the scale of your own, between questionnaires as well as at review time. [TPRM](https://www.deepinfo.com/platform/tprm/) ### What You Can Take Into the Room. #### Reports PDF reports from the executive summary and weekly progress to asset, vulnerability and issue detail, generated on demand or on a schedule. #### [Priorities You Can Defend](https://www.deepinfo.com/why-deepinfo/) CVEs ranked by CVSS, EPSS and CISA KEV together, so the list starts with what is exploited or likely to be, and says why. #### [Compliance Mapping](https://www.deepinfo.com/platform/tprm/compliance-tracking/) Each issue classified against OWASP Top 10 2021, PCI DSS 4.0 and 3.2, HIPAA, CWE, CAPEC and WASC, on your surface and your vendors’. #### [Decisions on Record](https://www.deepinfo.com/platform/how-it-works/) Accepted risk, false positives and ignored items are closed by a decision and kept with their history, so an audit can follow them. ### A Fix Counts When the Rescan Confirms It. A ticket marked done is a claim. *A rescan is the evidence.* An issue your team marks as resolved waits for the next scan. Only when the signal is gone does it become verified resolved, and if it comes back it reopens as reappeared. The progress you report is the progress the scans can show. ### Before You Put Us in Front of Your Own Review. - [Trust & security](https://www.deepinfo.com/trust/) (Company): Sub-processors, data handling and the disclosure policy. Security documentation is available on request. - [Methodology](https://www.deepinfo.com/methodology/) (Resources): How the data is collected, how assets are scanned and how findings are prioritized, and where the method stops. - [How we quote](https://www.deepinfo.com/pricing/) (Pricing): Priced on the scope you monitor and the modules you use, with a written number after one call. ### The Data Is Yours to Use Too The index under the platform is also sold as data. Teams that build their own tooling query it through the API or take it as bulk feeds, and Internet Insights shows what it sees each day. - [API Services](https://www.deepinfo.com/data-api/apis/) - [Data Feeds](https://www.deepinfo.com/data-api/feeds/) - [Internet Insights](https://www.deepinfo.com/insights/) ### Questions About Security Leaders **How is the security score calculated?** It is calculated per asset, per domain and for the whole surface, and it breaks down by asset, issue type and issue category, so you can see what moved it. The formula itself is not published. **What do we need to get started?** Your primary domains, and those of the vendors you want scored. Discovery proposes the rest for your team to approve, and nothing is installed in your environment. **Can the board pack be produced automatically?** Yes. Reports from the executive summary to issue detail can be scheduled daily, weekly or monthly, or generated on demand, as PDF. **Can we be alerted when the score drops?** Yes. A decrease or change in an asset’s or a domain’s security score is a notification event. A rule emails the people it names, instantly or as an hourly, daily, weekly or monthly digest. **Can scores feed our own dashboards?** Yes. The [EASM API](https://docs.deepinfo.com/reference/easm/) returns score timelines per asset, per domain and for the whole surface, with issue and vulnerability severity timelines beside them, for a BI tool or an internal dashboard to read. **How do we assess Deepinfo as a vendor?** Start with [Trust & security](https://www.deepinfo.com/trust/): sub-processors, data handling and the disclosure policy. Security documentation for your review is available on request from the security team. ### Bring the Next Board Question to a Demo. We run the platform on your domains and your key vendors, and show the score, the trend and the report you would take into the room. [Request demo](https://www.deepinfo.com/request-demo/)