Defense
Defense Exposure Spans the Group and Every Supplier Tier.
Defense adversaries plan over years and enter wherever the perimeter is weakest: a subsidiary nobody inventoried, a small component supplier, an engineer’s leaked password. The Deepinfo Platform maps the group’s external surface, scans each supplier at the parent’s depth, and profiles the threat actors that name your sector as a target.
- Asset discovery: inside the fence, a subsidiary’s workshop nobody inventoried: defense-systems.example, not in inventory.
- Continuous scanning: on the plant’s sawtooth roof, a unit that was not there at the last scan: plant.defense.example, 8443/tcp newly open, high, caught between two scans.
- Risk detection: at the gate, the visitors’ sign-in kiosk: visitors.defense.example, certificate expiring, medium.
- Risk scoring: on the engineering office’s top floor, a server: eng.defense.example runs Apache httpd 2.4.49: CVE-2021-41773, CVSS 9.8, listed in CISA KEV, critical.
- Cyber Threat Intelligence: in the engineering office, an engineer’s infected laptop: programs.defense.example login, in an infostealer log.
- Brand Risk Protection: outside the fence, a suppliers’ sign that is not yours: defense-suppliers.example, lookalike · contains.
- Third-Party Risk Management: past the fence, a tier-1 supplier’s works and a tier-2 machine shop, drawn dashed because they are not yours: avionics-supplier.example, graded A; machining-tier2.example, graded C, each linked to defense.example.
Group, Suppliers and People Make One Target.
Adversaries in this sector look for the weakest way in, wherever it sits. A defense program has to see the group, its suppliers and its people as one surface.
The group
Subsidiaries and Joint Ventures
Acquisitions, regional entities and joint ventures bring their own domains, hosts and certificates. Some run on infrastructure shared with partners.
The supply chain
Suppliers at Each Tier
A prime contractor depends on sub-suppliers and component makers, each with its own internet footprint. Reaching a prime through a small supplier is a known route.
The people
Engineers and Program Leads
Their corporate addresses turn up in breach data and their devices in infostealer logs. One saved password can open a program’s systems.
Suppliers Scanned at the Parent’s Depth.
Each supplier is a portfolio in Third-Party Risk Management, on the data layers and scoring External Attack Surface Management runs on your assets. The depth doesn’t drop with the tier: a component maker is scanned the way a prime partner is.
-
defense.example
-
composites-co.example
C→D
-
avionics-supplier.example
A
-
machining-tier2.example
C
-
logistics-co.example
B
-
it-msp.example
B
-
test-lab.example
C
-
cloud-hosting.example
A
-
subsidiary-eu.example
B
-
design-agency.example
B
Know Which Groups Name Your Sector.
Threat Actor Intelligence in Cyber Threat Intelligence profiles each group by who it targets and how it operates. Start from the actors that list defense among their targeted industries, and compare the CVEs they use with the vulnerabilities on your own and your suppliers’ assets to decide what gets patched first.
| Targets | Regions, countries, industries and organizations each actor goes after |
|---|---|
| Capabilities | The CVEs and tools the actor uses |
| Activity | Leak names, forums and markets where the actor appears |
| Profile | Size, types, sophistication and specializations |
| Aggregates | Most-used CVEs and tools, most-targeted countries, industries and organizations |
The People Behind the Programs.
Cyber Threat Intelligence finds employee addresses in known breaches and infostealer infections on the devices your people use, with counts of the saved passwords, tokens and cookies each log holds.
Flag executives and key personnel, and their breached accounts and leaked credentials become a list of their own. Your team works each record to a recorded state.
DEFENSE-LT-masked
Infostealer log
-
1Infected device CTIone device, counted once:
HWIDmasked
-
[Passwords]41 saved
-
2A program’s login CTIwith its password:
URLhttps://
programs.defense.example USER j.masked@defense.example
PASS masked
-
3The host nobody listed EASMand now its password:
URLhttps://
defense-systems.example USER j.masked
PASS masked
-
4Session cookies CTIpast the password and MFA:
[Cookies]1,208 · 36 sensitive
-
[Autofill] · [Tokens]312 · 4
-
5Password reuse CTIone password, many sites:
SamePassword63%
Tied to one device, one account and one person, so your team resets the right login and cleans the right laptop.
Record openednewly_detected
- Per device
- Hardware ID, user and system details
- Counts
- Passwords, tokens, autofills, cookies
- Signals
- Sensitive cookies, same-password rate
- Per person
- Executive flag on employee accounts
From Supplier Tiers to Program Leads.
Supply Chain Security
All supplier tiers, monitored as deeply as your surface.
Third-Party Risk Management
Suppliers onboarded as portfolios, scored before and during the contract.
Subsidiary Oversight
Each subsidiary and joint venture scored on the parent’s scale.
Mergers and Acquisitions Due Diligence
A target’s external posture before signing, and its inherited assets after.
Executive Threat Protection
Leaked accounts and credentials of the people you flag, as their own list.
Data Leak Detection
Your brands, domains and people named on forums, markets and leak sites.
Threat Hunting
Hypotheses tested against the index: reverse lookups, same-time registrations, certificate pivots.
Incident Investigation and Response
The infrastructure behind an indicator, traced while the incident is open.
The Data Is Yours to Use Too
The index under the platform is also sold as data. Teams that build their own tooling query it through the API or take it as bulk feeds, and Internet Insights shows what it sees each day.
Questions About Deepinfo in Defense
Can we monitor suppliers without their involvement?
Yes. Third-Party Risk Management works from what a supplier exposes on the internet, starting from its primary domain, so no agent, access or questionnaire is needed. Questionnaires still cover what only the supplier knows.
How does the platform cover subsidiaries and joint ventures?
Each entity can be its own portfolio, with its own inventory, issues and a score that compares directly with the parent’s. Asset Discovery also proposes related domains it finds through shared registrants, mail servers and IP addresses.
Does the platform need access to our networks?
No. Everything is read from the internet, starting from your primary domains, and nothing is installed in your environment. Your team approves which discovered assets join monitoring.
Can supplier scores feed procurement decisions?
Yes. A prospective supplier can be added as a portfolio from its primary domain and scanned before a contract is signed, on the same scale as current suppliers. The manufacturer in our customer story evaluates tier-1 and tier-2 suppliers against their score.
Can we read a supplier’s history from before monitoring?
For its domains, yes. WHOIS and DNS history come from the index and cover what it observed before you added the supplier. Scores and per-asset history start when the supplier joins as a portfolio.
Does the platform map to defense-sector security requirements?
Not as a classification. Defense requirements differ by country and by contract, while the platform classifies issues against general frameworks such as OWASP Top 10 2021 and CWE. Scheduled reports and each issue’s state history give your auditors dated evidence for whichever requirement applies.
See the Group and Its Suppliers on One Scale.
Bring your group domains and a short list of suppliers to a working demo.