Customer story · Cybersecurity · United States
A Cybersecurity Ratings Provider Builds on the Deepinfo Index.
A leading US-headquartered ratings provider scores the external posture of millions of organizations. Its product depends on internet-wide visibility, and sourcing that visibility from Deepinfo lets its engineers work on scoring instead of running an internet observatory.
Deepinfo index
-
Domains and subdomainsbulk files: all domains, all subdomains, daily registered, updated, deleted, discovered
-
DNS recordslive DNS lookup · passive DNS history
-
Certificateslive SSL lookup · issuer, validity, SAN names, chain validity
-
Technology fingerprintstechnology detection with CPE names
-
CVE enrichmentCVSS, CWE, EPSS and CISA KEV status
The customer’s scoring model
-
their model, not oursa score for each organization
Build an Observatory or Build the Product.
Its enterprise customers use the ratings for vendor risk, M&A due diligence and benchmarking, so the data underneath has to be complete and current. Collecting it at internet scale is a multi-year engineering program of its own, focused on infrastructure rather than the product.
Collect
Registrations and Certificates
A domain corpus that stays current, and certificate transparency monitoring.
Resolve
DNS, Ports and the Web
DNS state, port exposure and technology fingerprints for each host.
Enrich
Vulnerabilities
CVE enrichment for everything the fingerprints find.
Signals Go In and Scores Come Out.
The customer integrated Deepinfo API Services and Data Feeds into its scoring pipeline. Its engineers consume structured records directly and spend their own effort on the model and the product.
| Signal | Where it lives in the Deepinfo API |
|---|---|
| Domains and subdomains | Bulk files: all domains, all subdomains, and daily registered, updated, deleted and discovered. Feeds |
| DNS records | Live DNS lookup, and passive DNS history per domain. Lookup |
| Certificates | Live SSL lookup: issuer, validity, every SAN name, signature and chain validity. SSL |
| Technology fingerprints | Technology detection with CPE names, the link from a host to CVE data. Lookup |
| CVE enrichment | CVSS, CWE, EPSS and CISA KEV status for each CVE. Vulnerability |
Signals as the story names them. The right column describes the documented Deepinfo API only.
What Changed for Product Engineering.
A Sourced Data Layer
The product’s source data comes from Deepinfo API Services and Data Feeds.
Engineers on the Model
The team works on the scoring model and the customer-facing product instead of collection infrastructure.
Faster Product Velocity
Work on the core product sped up once the team stopped maintaining collection for capabilities Deepinfo already runs.
New Signals, Sooner
Adding a data signal to the product takes less time, as Deepinfo’s roadmap follows what rating signals need.
A Build Avoided
The cost and complexity of a multi-year collection program stayed off the roadmap.
DeepinfoAPI Services and Data Feeds
The customer’s engineersthe model and the product
- Collect · registrations and certificates (Deepinfo)
- Resolve · DNS, ports and the web (Deepinfo)
- Enrich · vulnerabilities (Deepinfo)
- The scoring model (The customer’s engineers)
- The customer-facing product (The customer’s engineers)
See What You Can Build on the Dataset.
Talk to us about Deepinfo API Services and Data Feeds. The data behind the Deepinfo Platform is available to your product.