# Defense URL: https://www.deepinfo.com/solutions/industries/defense/ ## Defense Exposure Spans the Group and Every Supplier Tier. Defense adversaries plan over years and enter wherever the perimeter is weakest: a subsidiary nobody inventoried, a small component supplier, an engineer’s leaked password. The Deepinfo Platform maps the group’s external surface, scans each supplier at the parent’s depth, and profiles the threat actors that name your sector as a target. [Request demo](https://www.deepinfo.com/request-demo/) ### Group, Suppliers and People Make One Target. Adversaries in this sector look for the weakest way in, wherever it sits. A defense program has to see the group, its suppliers and its people as one surface. The group #### Subsidiaries and Joint Ventures Acquisitions, regional entities and joint ventures bring their own domains, hosts and certificates. Some run on infrastructure shared with partners. The supply chain #### Suppliers at Each Tier A prime contractor depends on sub-suppliers and component makers, each with its own internet footprint. Reaching a prime through a small supplier is a known route. The people #### Engineers and Program Leads Their corporate addresses turn up in breach data and their devices in infostealer logs. One saved password can open a program’s systems. ### Suppliers Scanned at the Parent’s Depth. Each supplier is a portfolio in [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/), on the data layers and scoring [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) runs on your assets. The depth doesn’t drop with the tier: a component maker is scanned the way a prime partner is. ### Know Which Groups Name Your Sector. Threat Actor Intelligence in [Cyber Threat Intelligence](https://www.deepinfo.com/platform/cti/) profiles each group by who it targets and how it operates. Start from the actors that list defense among their targeted industries, and compare the CVEs they use with the vulnerabilities on your own and your suppliers’ assets to decide what gets patched first. - **Targets**: Regions, countries, industries and organizations each actor goes after - **Capabilities**: The CVEs and tools the actor uses - **Activity**: Leak names, forums and markets where the actor appears - **Profile**: Size, types, sophistication and specializations - **Aggregates**: Most-used CVEs and tools, most-targeted countries, industries and organizations ### The People Behind the Programs. Cyber Threat Intelligence finds employee addresses in known breaches and infostealer infections on the devices your people use, with counts of the saved passwords, tokens and cookies each log holds. Flag executives and key personnel, and their breached accounts and leaked credentials become a list of their own. Your team works each record to a recorded state. - [Employee Email Breach Monitoring](https://www.deepinfo.com/platform/cti/employee-email-breach-monitoring/) - [Compromised Employee Device Monitoring](https://www.deepinfo.com/platform/cti/compromised-employee-device-monitoring/) - [Executive Threat Monitoring](https://www.deepinfo.com/platform/cti/executive-threat-monitoring/) - [Dark Web Mentions Monitoring](https://www.deepinfo.com/platform/cti/dark-web-mentions-monitoring/) - **Per device**: Hardware ID, user and system details - **Counts**: Passwords, tokens, autofills, cookies - **Signals**: Sensitive cookies, same-password rate - **Per person**: Executive flag on employee accounts ### From Supplier Tiers to Program Leads. #### [Supply Chain Security](https://www.deepinfo.com/solutions/use-cases/supply-chain-security/) All supplier tiers, monitored as deeply as your surface. #### [Third-Party Risk Management](https://www.deepinfo.com/solutions/use-cases/third-party-risk-management/) Suppliers onboarded as portfolios, scored before and during the contract. #### [Subsidiary Oversight](https://www.deepinfo.com/solutions/use-cases/subsidiary-oversight/) Each subsidiary and joint venture scored on the parent’s scale. #### [Mergers and Acquisitions Due Diligence](https://www.deepinfo.com/solutions/use-cases/mergers-acquisitions-due-diligence/) A target’s external posture before signing, and its inherited assets after. #### [Executive Threat Protection](https://www.deepinfo.com/solutions/use-cases/executive-threat-protection/) Leaked accounts and credentials of the people you flag, as their own list. #### [Data Leak Detection](https://www.deepinfo.com/solutions/use-cases/data-leak-detection/) Your brands, domains and people named on forums, markets and leak sites. #### [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) Hypotheses tested against the index: reverse lookups, same-time registrations, certificate pivots. #### [Incident Investigation and Response](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) The infrastructure behind an indicator, traced while the incident is open. ### From One Manufacturer to Your Group. - [A defense manufacturer](https://www.deepinfo.com/customers/defense-manufacturer/) (Customer story): External monitoring extended across subsidiary brands and the tier-1 supply chain. - [Aviation](https://www.deepinfo.com/solutions/industries/aviation/) (Industry): Partners and maintenance providers scanned the way you are. - [Government](https://www.deepinfo.com/solutions/industries/government/) (Industry): Public institutions and the suppliers that run services for them. ### The Data Is Yours to Use Too The index under the platform is also sold as data. Teams that build their own tooling query it through the API or take it as bulk feeds, and Internet Insights shows what it sees each day. - [API Services](https://www.deepinfo.com/data-api/apis/) - [Data Feeds](https://www.deepinfo.com/data-api/feeds/) - [Internet Insights](https://www.deepinfo.com/insights/) ### Questions About Deepinfo in Defense **Can we monitor suppliers without their involvement?** Yes. Third-Party Risk Management works from what a supplier exposes on the internet, starting from its primary domain, so no agent, access or questionnaire is needed. Questionnaires still cover what only the supplier knows. **How does the platform cover subsidiaries and joint ventures?** Each entity can be its own portfolio, with its own inventory, issues and a score that compares directly with the parent’s. Asset Discovery also proposes related domains it finds through shared registrants, mail servers and IP addresses. **Does the platform need access to our networks?** No. Everything is read from the internet, starting from your primary domains, and nothing is installed in your environment. Your team approves which discovered assets join monitoring. **Can supplier scores feed procurement decisions?** Yes. A prospective supplier can be added as a portfolio from its primary domain and scanned before a contract is signed, on the same scale as current suppliers. The manufacturer in our [customer story](https://www.deepinfo.com/customers/defense-manufacturer/) evaluates tier-1 and tier-2 suppliers against their score. **Can we read a supplier’s history from before monitoring?** For its domains, yes. WHOIS and DNS history come from the index and cover what it observed before you added the supplier. Scores and per-asset history start when the supplier joins as a portfolio. **Does the platform map to defense-sector security requirements?** Not as a classification. Defense requirements differ by country and by contract, while the platform classifies issues against general frameworks such as OWASP Top 10 2021 and CWE. Scheduled reports and each issue’s state history give your auditors dated evidence for whichever requirement applies. ### See the Group and Its Suppliers on One Scale. Bring your group domains and a short list of suppliers to a working demo. [Request demo](https://www.deepinfo.com/request-demo/)