# Blog

URL: https://www.deepinfo.com/blog/

## How Detection Works and Where It Stops.

Opinion and mechanism from the team that builds the Deepinfo Platform and runs the index underneath it.

Each post shows how a capability works and is plain about where it ends.

[Subscribe](https://www.deepinfo.com/blog/#newsletter) · [Read the latest post](https://www.deepinfo.com/blog/dark-web-monitoring-what-it-actually-catches/)

### Posts From Newest to Oldest.

Published 2026-06-19

#### [Dark Web Monitoring: What It Actually Catches](https://www.deepinfo.com/blog/dark-web-monitoring-what-it-actually-catches/)

Breach corpora, infostealer logs and actor mentions are where monitoring earns its keep. Closed groups, prediction and capability assessment are where it stops.

Published 2026-06-12

#### [The Vendor Risk Questionnaire Is Broken](https://www.deepinfo.com/blog/the-vendor-risk-questionnaire-is-broken/)

A questionnaire records what a vendor says. Four claims that continuous external monitoring can test, and the role the questionnaire keeps afterwards.

Published 2026-06-05

#### [Detecting Typosquats at Scale](https://www.deepinfo.com/blog/detecting-typosquats-at-scale/)

Match types on two axes, why detection that covers only the simpler ones leaves the rest open, and what a detection rule looks like in the API.

Published 2026-05-29

#### [The Attack Surface You Don’t Know You Own](https://www.deepinfo.com/blog/the-attack-surface-you-dont-know-you-own/)

Acquisitions, campaigns, retired systems, subsidiaries and shadow IT: five patterns that keep an inventory behind the real attack surface, and why discovery is not scanning.

Published 2026-05-22

#### [Why We Index the Internet](https://www.deepinfo.com/blog/why-we-index-the-internet/)

Why Deepinfo runs its own index instead of renting one, and the lines we draw around personal data, collection, customer data and dark web sourcing.

Published 2026-05-15

#### [CTEM Is a Workflow, Not a Product Category](https://www.deepinfo.com/blog/ctem-is-not-a-product-category/)

The five CTEM stages in plain language, where single-stage tools break the loop, and the stage we are careful not to overclaim.

Opinion is welcome here. *Opinion instead of evidence* is not.

Numbers come from our own index or from a public source we can name. Examples use reserved names such as `acme.example`, never another organization’s real domain.

When a capability has limits, the post names them, including the limits of our own platform.

### Get New Posts in Your Inbox.

Low volume: the posts, when they ship, and nothing else.

### Reference Reading We Keep Current.

- [Methodology](https://www.deepinfo.com/methodology/) (Reference): How the data is collected, how monitored assets are scanned and how risk is scored.
- [Glossary](https://www.deepinfo.com/glossary/) (Reference): The terms these posts use, from CISA KEV to homoglyph attack.
- [Internet insights](https://www.deepinfo.com/insights/) (Live data): Domain registrations and vulnerability trends, drawn from the index.

### See These Patterns on Your Domain.

Book a walk-through of the Deepinfo Platform with our team.

[Request demo](https://www.deepinfo.com/request-demo/)