Security Leaders
Answer the Board With Evidence.
The board asks how exposed the company is, whether it is getting better and which vendors put it at risk. The Deepinfo Platform answers each one from scans of what you and your vendors expose to the internet, with the issues and their evidence underneath.
acme.example
Executive summary
- 412 assets monitored
- 2 issues open
- 1 vendor below your threshold
-
Security scoreup over the quarter · by domain and for the whole surface
-
Open issues
- Critical RDP exposed on a forgotten host
- Medium certificate expires in 6 days
2 issues open:
-
Verified fixesconfirmed by a rescan, not by a ticket
-
Vendorspayroll.example · score fell C to D
1 vendor below your threshold:
-
Compliance mappingOWASP Top 10, PCI DSS 4.0, HIPAA
PDF, on demand or on a schedule.
Three Questions the Board Keeps Asking.
Each one has an answer in the platform that rests on scans, not on self-assessment.
Exposure
How Exposed Are We?
A security score for each asset, each domain and the whole attack surface, with the issues behind it broken down by asset, type and category.
Progress
Are We Getting Better?
The score’s trend over days, weeks and months, and fixes that count only once a rescan confirms the signal is gone.
Vendors
Which Vendors Put Us at Risk?
Third parties scanned by the engine that scans your surface and scored on the scale of your own, between questionnaires as well as at review time.
What You Can Take Into the Room.
Reports
PDF reports from the executive summary and weekly progress to asset, vulnerability and issue detail, generated on demand or on a schedule.
Priorities You Can Defend
CVEs ranked by CVSS, EPSS and CISA KEV together, so the list starts with what is exploited or likely to be, and says why.
Compliance Mapping
Each issue classified against OWASP Top 10 2021, PCI DSS 4.0 and 3.2, HIPAA, CWE, CAPEC and WASC, on your surface and your vendors’.
Decisions on Record
Accepted risk, false positives and ignored items are closed by a decision and kept with their history, so an audit can follow them.
A Fix Counts When the Rescan Confirms It.
A ticket marked done is a claim. A rescan is the evidence.
An issue your team marks as resolved waits for the next scan. Only when the signal is gone does it become verified resolved, and if it comes back it reopens as reappeared.
The progress you report is the progress the scans can show.
Found
Open
The team can decide
Each scan checks
newly detected
orreappeared
unresolved
checked again on every scan
optional, kept on record
marked as resolvedrisk acceptedignoredmarked as false positive
verified resolved
the signal is gone: no one has to mark itnot applicablewhen a scan cannot tell
The Data Is Yours to Use Too
The index under the platform is also sold as data. Teams that build their own tooling query it through the API or take it as bulk feeds, and Internet Insights shows what it sees each day.
Questions About Security Leaders
How is the security score calculated?
It is calculated per asset, per domain and for the whole surface, and it breaks down by asset, issue type and issue category, so you can see what moved it. The formula itself is not published.
What do we need to get started?
Your primary domains, and those of the vendors you want scored. Discovery proposes the rest for your team to approve, and nothing is installed in your environment.
Can the board pack be produced automatically?
Yes. Reports from the executive summary to issue detail can be scheduled daily, weekly or monthly, or generated on demand, as PDF.
Can we be alerted when the score drops?
Yes. A decrease or change in an asset’s or a domain’s security score is a notification event. A rule emails the people it names, instantly or as an hourly, daily, weekly or monthly digest.
Can scores feed our own dashboards?
Yes. The EASM API returns score timelines per asset, per domain and for the whole surface, with issue and vulnerability severity timelines beside them, for a BI tool or an internal dashboard to read.
How do we assess Deepinfo as a vendor?
Start with Trust & security: sub-processors, data handling and the disclosure policy. Security documentation for your review is available on request from the security team.
Bring the Next Board Question to a Demo.
We run the platform on your domains and your key vendors, and show the score, the trend and the report you would take into the room.