Blog
How Detection Works and Where It Stops.
Opinion and mechanism from the team that builds the Deepinfo Platform and runs the index underneath it.
Each post shows how a capability works and is plain about where it ends.
| Works | Stops | |
|---|---|---|
| CTI: read the post | breach corpus matches · infostealer logs · actor mentions | closed actor operations · prediction · capability assessment |
| TPRM: read the post | what the vendor’s internet-facing assets show | inside a vendor’s incident response |
| BRP: read the post | every match type, from exact to confusable_ |
matches land as suspicious, for your team to review |
| EASM: read the post | discovery finds what the inventory missed | a shared IP address is a lead, not proof of ownership |
| Data: read the post | passive DNS, certificate transparency, public WHOIS and IP WHOIS, crawling | no collection behind authentication |
| CTEM: read the post | a rescan confirms a fix before it closes as verified resolved | proving an attack path works is penetration testing’s job |
Posts From Newest to Oldest.
Dark Web Monitoring: What It Actually Catches
Breach corpora, infostealer logs and actor mentions are where monitoring earns its keep. Closed groups, prediction and capability assessment are where it stops.
The Vendor Risk Questionnaire Is Broken
A questionnaire records what a vendor says. Four claims that continuous external monitoring can test, and the role the questionnaire keeps afterwards.
Detecting Typosquats at Scale
Match types on two axes, why detection that covers only the simpler ones leaves the rest open, and what a detection rule looks like in the API.
The Attack Surface You Don’t Know You Own
Acquisitions, campaigns, retired systems, subsidiaries and shadow IT: five patterns that keep an inventory behind the real attack surface, and why discovery is not scanning.
Why We Index the Internet
Why Deepinfo runs its own index instead of renting one, and the lines we draw around personal data, collection, customer data and dark web sourcing.
CTEM Is a Workflow, Not a Product Category
The five CTEM stages in plain language, where single-stage tools break the loop, and the stage we are careful not to overclaim.
Opinion is welcome here. Opinion instead of evidence is not.
Numbers come from our own index or from a public source we can name. Examples use reserved names such as acme.example, never another organization’s real domain.
When a capability has limits, the post names them, including the limits of our own platform.
See These Patterns on Your Domain.
Book a walk-through of the Deepinfo Platform with our team.