Use cases
The Workflows Security Teams Run.
Each use case is a job security teams run on the Deepinfo Platform, written the way they run it: the problem, the modules that handle it, and the steps from first finding to closed.
They are grouped by where the exposure lives, from your surface down to the index your analysts query directly.
-
Your own assets
Modules: EASM CTI TPRM DSI
-
Your brand
Modules: CTI BRP DSI
-
Who you depend on
Modules: EASM CTI TPRM DSI
-
What already leaked
Modules: EASM CTI BRP TPRM DSI
-
The index
Modules: EASM CTI DSI
Know Your Surface and Its Exposures.
Everything starts with an inventory that matches what answers on the internet, and a queue ranked by what attackers are likely to use.
Attack Surface Management
Find every domain, subdomain and IP tied to your organization, then keep the inventory current as it changes.
Vulnerability Management
Rank the CVEs on your internet-facing assets by CVSS, EPSS and CISA KEV together, and work each one to a verified fix.
Security Risk Scoring
One scoring model for your surface, your subsidiaries and your vendors, so a score means one thing everywhere.
Compliance and Audit Readiness
Findings classified against compliance frameworks as they are detected, with the state history an auditor can trace.
Find What’s Built to Look Like You.
Lookalike domains, impersonating accounts and fake apps trade on your name. These workflows find them, weigh the evidence and get them removed.
BRP
Brand Impersonation Protection
Lookalike domains, impersonating accounts, apps and search results, confirmed by your team and handed to takedown.
BRP · DSI
Phishing Detection and Prevention
Match new domains against your brand, down to confusable characters, and watch the ones that start to resolve, take mail or serve a certificate.
CTI · BRP
Fraud Prevention
Your customers’ leaked logins and cards on one side, lookalike infrastructure on the other, worked by one fraud team.
BRP
Managed Takedown Services
Hand confirmed impersonation to Deepinfo’s takedown team, which files with the party that can act and checks the result.
Watch the Organizations You Depend On.
Vendors, suppliers, subsidiaries and acquisition targets each run as a portfolio on the engine that scans your surface, so all of them are read on one scale.
Third-Party Risk Management
Assess vendors with the layer-by-layer scanning and scoring you run on your surface, not on questionnaires alone.
Supply Chain Security
Extend that watch past direct suppliers to the providers they depend on, with threat actor context for your sector.
Subsidiary Oversight
Run each group company as its own portfolio and read all of them side by side on one scale.
Mergers and Acquisitions Due Diligence
Map and score a target’s external surface before the deal closes, and read its registration and DNS history.
Cyber Insurance Assessment
Base underwriting and renewals on observed external posture instead of self-reported answers.
-
acme.example
A
-
payroll.example
C→D
remote.payroll.example· 3389/tcp newly open Critical · not on the vendor’s listdocs.payroll.example· CVE-2021-41773 Critical KEV- The way in: payroll.example → acme.example. Their exposure becomes yours.
-
cloud-hosting.example
A
-
cdn-provider.example
A
-
logistics-co.example
B
-
law-firm.example
C
-
call-center.example
C
-
marketing-agency.example
B
-
subsidiary-eu.example
B
-
crm-saas.example
A
Track What Has Already Leaked.
Breach data, infostealer logs, forums, markets and leak sites. These workflows find what concerns you there and hand it to the team that can act.
Dark Web Monitoring
Search and watch forums, markets, paste sites, leak sites and chats for your domains, brands and people.
Credential Exposure Management
Employee, customer and payment credentials from breaches and infostealer logs, each worked through a recorded state.
Data Leak Detection
Watch for your data where leaks surface, and close the exposed services on your surface where they start.
Ransomware Exposure Monitoring
Close the ways in that ransomware crews use, and watch leak sites for your name and your vendors’ names.
Executive Threat Protection
Flag executives and VIPs so breaches, leaked credentials and impersonations that touch leadership are handled first.
Investigate With the Index Itself.
The data under each module is open to your analysts and developers: domains, DNS, WHOIS, certificates, vulnerabilities and the dark web, with history.
DSI · CTI
Threat Hunting
Test hypotheses against the domain, DNS, certificate and CVE data under the platform, then pivot from whatever turns up.
CTI · DSI
Threat Intelligence Operations
Bring dark web search, threat actor profiles and indicators into the workflows your analysts already run.
DSI · CTI · EASM
Incident Investigation and Response
Pivot from one indicator to the infrastructure around it, with reverse lookups, DNS and WHOIS history and your assets’ scan history.
DSI
Domain Intelligence and Research
Query registrations, DNS, WHOIS and certificates across the index, with the history behind each record.
Start From a Module Instead.
The map above, read the other way. The modules all read one dataset, so a workflow that starts on one can add another without starting over.
| EASM | External Attack Surface Management: attack surface management, vulnerability management, security risk scoring, compliance, third-party risk, supply chain, subsidiaries, M&A due diligence, cyber insurance, data leaks, ransomware, incident response |
|---|---|
| CTI | Cyber Threat Intelligence: dark web monitoring, credential exposure, data leaks, ransomware, executive threats, fraud, supply chain, vulnerability management, threat hunting, intelligence operations, incident response |
| BRP | Brand Risk Protection: brand impersonation, phishing, fraud, managed takedown, executive threats |
| TPRM | Third-Party Risk Management: third-party risk, supply chain, subsidiaries, cyber insurance, security risk scoring, compliance, ransomware |
| DSI | Deep Search & Insights: domain research, threat hunting, incident response, intelligence operations, M&A due diligence, dark web monitoring, phishing, vulnerability management |
| Use case | External Attack Surface Management | Cyber Threat Intelligence | Brand Risk Protection | Third-Party Risk Management | Deep Search & Insights |
|---|---|---|---|---|---|
| Your own assets | |||||
| Attack Surface Management | runs on EASM | no | no | no | no |
| Vulnerability Management | runs on EASM | runs on CTI | no | no | runs on DSI |
| Security Risk Scoring | runs on EASM | no | no | runs on TPRM | no |
| Compliance and Audit Readiness | runs on EASM | no | no | runs on TPRM | no |
| Your brand | |||||
| Brand Impersonation Protection | no | no | runs on BRP | no | no |
| Phishing Detection and Prevention | no | no | runs on BRP | no | runs on DSI |
| Fraud Prevention | no | runs on CTI | runs on BRP | no | no |
| Managed Takedown Services | no | no | runs on BRP | no | no |
| Who you depend on | |||||
| Third-Party Risk Management | runs on EASM | no | no | runs on TPRM | no |
| Supply Chain Security | runs on EASM | runs on CTI | no | runs on TPRM | no |
| Subsidiary Oversight | runs on EASM | no | no | runs on TPRM | no |
| Mergers and Acquisitions Due Diligence | runs on EASM | no | no | no | runs on DSI |
| Cyber Insurance Assessment | runs on EASM | no | no | runs on TPRM | no |
| What already leaked | |||||
| Dark Web Monitoring | no | runs on CTI | no | no | runs on DSI |
| Credential Exposure Management | no | runs on CTI | no | no | no |
| Data Leak Detection | runs on EASM | runs on CTI | no | no | no |
| Ransomware Exposure Monitoring | runs on EASM | runs on CTI | no | runs on TPRM | no |
| Executive Threat Protection | no | runs on CTI | runs on BRP | no | no |
| The index | |||||
| Threat Hunting | no | runs on CTI | no | no | runs on DSI |
| Threat Intelligence Operations | no | runs on CTI | no | no | runs on DSI |
| Incident Investigation and Response | runs on EASM | runs on CTI | no | no | runs on DSI |
| Domain Intelligence and Research | no | no | no | no | runs on DSI |
Questions About Use Cases
Is each use case a separate product?
No. Each one runs on the modules tagged beside it, and pricing follows the scope you monitor and the modules you use. See pricing.
Which workflow should we start with?
If nobody can say with confidence which hosts your organization exposes, start with Attack Surface Management. Vulnerability management, risk scoring and compliance evidence all work from the inventory it builds.
How do findings reach the people who fix them?
Through notification rules, scheduled PDF reports and exports. A rule picks an event, such as a new issue, a new fraudulent domain or a new email breach, and emails the team members it names, instantly or as an hourly, daily, weekly or monthly digest.
What data do the workflows read?
Deepinfo’s own index of 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates, a CVE database enriched with EPSS, CISA KEV and CWE, and the breach data, infostealer logs and dark web sources behind Cyber Threat Intelligence.
Can these workflows run through the API?
Yes. External Attack Surface Management, Cyber Threat Intelligence and Brand Risk Protection each have an API under one apikey header, with search, export and bulk actions driven by one filter syntax. Deep Search & Insights is available as Deepinfo API Services and Data Feeds.
Bring the Workflow We Didn’t List.
If your team runs something that isn’t on this page, tell us what you’re trying to do. We’ll say plainly whether the platform fits.