How it works

From Raw Internet Data to a Verified Fix.

The Deepinfo Platform collects and resolves its own index, discovers your assets from a seed, scans them layer by layer, ranks what it finds and tracks each issue until a rescan confirms it is gone.

This page follows that order, then covers what sits on top of all of it: notifications, reports and the API.

Request demo API reference Platform guide

assetstaging.acme.example

Collect · Resolve

subdomain → 203.0.113.7 → certificate
Discover (done)

proposed from acme.example · approved
Scan

whois ipwhois dns ssl port_scan webdata http
Detect · Prioritize

CVE-2021-41773 · CVSS 9.8 · in CISA KEV
Track (done)

newly_detected → verified_resolved · re-scan confirms
Notify · Report

New issue detected

It Starts With an Index We Build.

Before your team adds a single domain, the platform is already collecting registrations, DNS records, certificates and subdomains across all TLDs.

Resolution ties them together: each subdomain to the IP addresses it answers on, each certificate to the names it covers, each record to its own history. The steps after this one query that index instead of starting from zero.

Methodology

400M+ domains	Across every TLD, with registration and WHOIS history
2B+ subdomains	Discovered, then resolved to the IPs they answer on
200B+ DNS records	Every observed record, kept with its history
30B+ SSL certificates	Each tied to the names it covers

Start From One Seed and Follow What Connects to It.

Discovery treats your inventory as a hypothesis. It proposes what the index says belongs to you, and your team decides.

01

Seed

Add your primary domain in the platform, or a whole list of assets in one API call. Discovery runs from each asset marked as a seed.
02

Expand

Forward enumeration finds subdomains through passive DNS, certificate transparency and crawling. Reverse lookups by IP, mail server, name server and registrant email find the domains that share your infrastructure.
03

Review

Candidates land in a discovery queue. Smart rules maintained by Deepinfo and custom rules your team writes can propose assets or approve them automatically.
04

Monitor

Approved assets join the monitored inventory and enter the scan cycle. Ignored candidates stay out, and any decision can be reverted later.

Each Layer Is Scanned and Keeps Its History.

Monitored assets are rescanned on the platform’s own schedule, and any asset can be scanned on demand. Each layer is stored separately, so a change shows up as a change, with the before and the after.

Snapshots are kept per layer and can be listed and retrieved through the API. WHOIS, DNS and SSL changes and newly opened ports are notification events of their own.

WHOIS: registrar, registration and expiry dates, registrant where published
IP WHOIS: ASN, network owner and country
DNS: A, AAAA, MX, NS, SOA, TXT and other record types
SSL: certificate, issuer, validity and the names it covers
Ports: open TCP and UDP ports and the services behind them
Web data: page content, technologies, login pages and screenshots
HTTP: response headers and status codes

Scanall checked

staging.acme.example 203.0.113.7 · monitored

WHOISwhois

acme.example · unchanged

09-17 → 09-24
IP WHOISipwhois

AS64500 · unchanged

09-17 → 09-24
DNSdns

A 203.0.113.7 · unchanged

09-17 → 09-24
SSLssl

certificate reissued · new expiry

09-17 → 09-24
changed
Portsport_scan

8080/tcp newly open (changed)

09-17 → 09-24
Medium
Web datawebdata

Apache httpd 2.4.49 · unchanged

09-17 → 09-24
HTTPhttp

200 · unchanged

09-17 → 09-24

Severity Is the Start. Exploitation Is the Question.

Each scan is checked for misconfigurations, weak or expiring certificates, exposed services and login pages, end-of-life technologies and known CVEs. Each issue carries a severity from Critical to Information, the evidence behind it and remediation guidance from its issue type.

Technologies are matched to CVEs through their CPE names. Each CVE is then enriched with EPSS, the probability of exploitation in the next 30 days, and checked against CISA’s Known Exploited Vulnerabilities catalog, so exploited and likely-to-be-exploited CVEs on exposed assets rise to the top.

CVSS base score and vector
EPSS probability and percentile
CISA KEV listing
CWE, mapped to OWASP Top 10 2021
vDeep, Deepinfo’s own CVSS scoring layer
A security score per asset and per domain, with a timeline

CVE on one of your assets

Fix first listed in CISA KEV, known to be exploited

CVE-2021-44228

CVSS 10.0

EPSS 0.99999 CISA KEV

Critical
CVE-2021-41773

CVSS 9.8

CISA KEV

Critical

The normal patch cycle EPSS low, not in CISA KEV

a CVE

CVSS 9.8

EPSS low

Critical
a CVE

CVSS 5.3

EPSS low

Medium

CVSS alone cannot tell the two 9.8s apart. CISA KEV and EPSS can.

Issues Have More States Than Open and Closed.

An issue moves from newly detected to unresolved, and every scan checks it again. When the signal is gone, the scan sets it verified resolved on its own, with no one having to mark it first; when a scan cannot tell, it sets not applicable. Your team can also mark it resolved, which the next scan still verifies, or close it as risk accepted, ignored or false positive, and each decision stays in the issue’s state history. A resolved signal that comes back reopens the issue as reappeared, and that reopening is a notification event of its own.

Found

Open

The team can decide

Each scan checks

newly detected

orreappeared

unresolved

checked again on every scan

optional, kept on record

marked as resolved
risk accepted
ignored
marked as false positive

verified resolved

the signal is gone: no one has to mark itnot applicablewhen a scan cannot tell

Pick the Events and Schedule the Reports.

A notification rule takes an event, optional conditions such as asset, severity or tag, a frequency and the team members to email. Reports follow that pattern, on demand or on a schedule.

Notifications

Delivered instantly, hourly, daily, weekly or monthly.

New issue detected
Reappeared issue detected
Asset security score decreased
Asset security score changed
Domain security score decreased
Domain security score changed
Asset SSL changed
Asset WHOIS changed
Asset DNS changed
New asset discovered
New open port detected
New vulnerability detected
Reappeared vulnerability detected
New email breach detected
New fraudulent domain detected

PDF

Reports

Generated on demand or scheduled daily, weekly or monthly, and downloaded as PDF.

EASM executive summary
EASM weekly progress
EASM asset detail
EASM vulnerability detail
EASM vulnerability overview
EASM issue overview
EASM issue detail
CTI email breach summary

Everything Above Works Through One API.

The platform API covers EASM, CTI, BRP, notifications and reports under one base URL, with one apikey header. Search endpoints share one filter syntax, and the same filter body drives bulk actions such as approve, ignore, accept risk, mark resolved and export.

Per-asset history is there too: DNS, reverse DNS, HTTP, IP WHOIS, port scan, SSL, web data and WHOIS snapshots, each listable and retrievable. For connectors into the rest of your stack, see integrations.

EASM API reference Platform API reference

curl -X POST \
  "https://api.deepinfo.com/v1/easm/assets/search" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "filters": {
    "must": [
      { "name": "asset_type",
        "type": "eq", "value": "domain" }
    ],
    "must_not": [
      { "name": "tags",
        "type": "in", "value": ["staging"] }
    ]
  },
  "sort": [
    { "field": "added_date", "order": "desc" }
  ]
}'

import requests

must = [
    {"name": "asset_type", "type": "eq", "value": "domain"},
]
must_not = [
    {"name": "tags", "type": "in", "value": ["staging"]},
]

r = requests.post(
    "https://api.deepinfo.com/v1/easm/assets/search",
    json={
        "filters": {"must": must, "must_not": must_not},
        "sort": [{"field": "added_date", "order": "desc"}],
    },
    headers={"apikey": "YOUR_API_KEY"},
)
print(r.json()["result_count"])

Query This Data Through the API

The index under every module is sold on its own too, as query APIs and bulk feeds.

Questions About How the Platform Works

How often are assets scanned?

Monitored assets are rescanned on the platform’s own schedule, without anyone on your team triggering it, and each layer keeps its history. When you need a fresh result right away, start an instant scan on any asset from the platform or with one API call.

Do discovered assets get monitored automatically?

Only if your team says so. Candidates wait in a discovery queue until someone approves them, or until a discovery rule your team set to auto-approve matches them. Ignored candidates stay out, and any decision can be reverted.

Is the scanning intrusive?

No. Standard monitoring runs no authenticated scans, no exploit attempts and no load tests, and it reaches only what a host already exposes to the internet. The methodology covers the details.

What happens when a fixed issue comes back?

The issue reopens as reappeared instead of being created again, so its history stays in one place. Reappeared issues and reappeared vulnerabilities are both notification events.

Which compliance frameworks are issues mapped to?

OWASP Top 10 (2021), PCI DSS 4.0, PCI DSS 3.2, HIPAA, CWE, CAPEC and WASC. Filtering issues by framework answers an audit question without a spreadsheet.

Can we see which notifications went out?

Yes. The platform keeps a log of the notification emails it has sent, each with the rule that triggered it, and the Notification Email List endpoint returns it.

How do scheduled reports reach people?

By email. A scheduled report rule sets the report type, a daily, weekly or monthly frequency and the team members who receive it.

Run the Platform Against Your Domain.

The mechanics are easiest to judge on your own surface. Book a working demo with our team.

Request demo

Platform

Solutions

Data & API

Resources

Company