The Vocabulary of Exposure Management.

A number assigned to a network operator, such as an ISP, a cloud provider or a large enterprise, that identifies its network for routing on the internet. Knowing which ASN announces an IP address tells you who operates the network behind it. Deepinfo records the ASN of each monitored IP in the IP WHOIS layer.

See IP WHOIS API · BGP

An internet-facing entity the Deepinfo Platform monitors: a domain, a subdomain or an IP address. Assets are the units that scanning, issue detection and scoring work on. Each one is scanned on all data layers and carries its own security score.

See External Attack Surface Management

A catalog of all the internet-facing assets that belong to an organization. Inventories kept by hand drift out of date as subsidiaries, campaigns and projects add infrastructure, and the gaps are what attackers look for. External Attack Surface Management keeps the inventory current by proposing newly discovered assets for your team to approve.

See Asset Discovery · Attack surface management

A knowledge base of adversary tactics and techniques, maintained by MITRE and built from real-world observations. Security teams use its technique IDs as a shared language for how threat actors operate, from initial access to impact.

See TTP · Threat actor

Everything an attacker can reach and interact with: systems, applications, services and data. The external attack surface is the part reachable from the internet, including domains, subdomains, IP addresses, cloud services and infrastructure that third parties host on an organization’s behalf.

See External Attack Surface Management

The protocol autonomous systems use to exchange routes, which decides how traffic travels between networks on the internet. In a BGP hijack, a network announces routes for address space it does not hold and draws in traffic meant for someone else.

See ASN

The use of a legitimate brand’s name, logo or visual identity to deceive people. It covers phishing pages, lookalike domains, fake mobile apps, fraudulent social accounts and counterfeit websites.

See Brand Risk Protection · Brand impersonation protection

Deepinfo’s module for finding brand impersonation. Fraudulent Domain Monitoring matches domains against your brand names, from exact and fuzzy matches to confusable characters, then watches each lookalike’s DNS, mail, certificate and web presence with a risk score over time.

The module also covers social platforms, app stores and search engines, and includes Managed Takedown.

See Brand Risk Protection · Fraudulent Domain Monitoring

A catalog maintained by MITRE that describes how common attacks work, pattern by pattern. Deepinfo classifies EASM issues against CAPEC, among other frameworks, and CVE records carry CAPEC IDs through their CWE.

See Compliance and audit readiness

A system of public, append-only logs that record the TLS certificates issued by publicly trusted certificate authorities. All the names on a logged certificate become public, so CT logs are a source for discovering subdomains and for spotting certificates issued for your domains that nobody on your team requested.

See SSL Lookup API · Subdomain enumeration

A catalog published by the US Cybersecurity and Infrastructure Security Agency that lists CVEs with evidence of exploitation in the wild. Each entry records the date it was added, the required action and a remediation due date for US federal agencies.

Deepinfo checks every CVE found on your assets against KEV and prioritizes with the listing, CVSS and EPSS together.

See Risk Scoring · Methodology

A match that holds once characters that look alike are treated as the same, such as a Cyrillic “а” standing in for a Latin “a”. Plain string comparison misses these domains, because the characters differ even when the rendered name looks identical.

The confusable match types in Fraudulent Domain Monitoring are confusable_exact, confusable_contains, confusable_fuzzy and confusable_fuzzy_contains.

See Fraudulent Domain Monitoring · Homoglyph attack

A program model introduced by Gartner that manages exposure in five stages: scoping, discovery, prioritization, validation and mobilization. It treats exposure as an ongoing program instead of a once-a-year audit.

The Deepinfo Platform supports it from the outside in, with discovery, prioritization and a tracked path from finding to fix.

See Platform · How it works

The discipline of collecting and analyzing information about adversaries and what they hold. In the Deepinfo Platform, Cyber Threat Intelligence is the module for exposures that already exist outside your perimeter.

It covers email breaches, infostealer infections on employee devices, leaked employee, client and payment credentials, dark web search, threat actor profiles and curated security news.

See Cyber Threat Intelligence

The standard identifier for a publicly disclosed vulnerability. Each CVE ID, such as CVE-2021-44228 (the Log4Shell flaw in Apache Log4j), comes with a description, the affected products and severity metadata. Deepinfo’s CVE records add EPSS, CISA KEV, CWE and vDeep enrichment.

See Vulnerability Search · Vulnerability Detail API

A standard for rating the severity of a vulnerability on a scale from 0.0 to 10.0. CVSS describes how bad a flaw could be, not whether anyone is exploiting it. Deepinfo ranks CVEs by CVSS, EPSS and CISA KEV together, so severity alone does not set the order.

See Risk Scoring · EPSS

A taxonomy of the weakness classes behind vulnerabilities in software and hardware. A CVE is one specific vulnerability; its CWE names the kind of mistake behind it, such as improper input validation. Deepinfo maps CWEs to the OWASP Top 10 (2021) and uses CWE as one of its compliance classifications.

See Vulnerability Intelligence

A score for an organization’s security posture, derived from what can be observed from outside: exposed services, certificate hygiene, breach history and patch status. Enterprises use ratings to compare vendors and to track them over time.

See Security risk scoring · Vendor Risk Scoring

Parts of the internet that standard search engines do not index and that need specific software, such as Tor or I2P, or an invitation to reach. Forums, markets and leak sites there trade stolen data and access. Deepinfo’s Dark Web Search queries these sources by free text or by an indicator, such as an email address, an email domain, an IP address or a card number.

See Dark Web Search · Dark web monitoring

The system that translates names into IP addresses. DNS records also route email (MX), delegate zones (NS), prove domain control (TXT) and point names at other names (CNAME), so they reveal a great deal about an organization’s infrastructure.

See DNS Lookup API · DNS History API

Registering domain names close to a legitimate brand to profit from mistyped traffic, sell the name back to the brand or stage attacks. The practice includes typosquatting, combosquatting (a brand name plus an extra word) and cybersquatting in general.

See Fraudulent Domain Monitoring · Typosquatting

Deepinfo’s module for querying the index directly: Domain Intelligence, Domain Search, Vulnerability Intelligence, Vulnerability Search and Instant Lookups. It is the data the other modules run on, and that data is also available as Deepinfo API Services and Data Feeds.

See Deep Search & Insights · Data & API

The category of security tooling that discovers, monitors and assesses what an organization exposes to the internet. Deepinfo’s EASM module covers asset discovery, continuous scanning across all data layers, risk detection, remediation tracking and risk scoring.

See External Attack Surface Management

A model maintained by FIRST that estimates the probability a CVE will be exploited in the wild in the next 30 days. Scores run from 0 to 1, and FIRST publishes new scores daily. Deepinfo enriches every CVE with its EPSS score and percentile, and keeps each CVE’s EPSS history.

See Risk Scoring · EPSS History API

The US Family Educational Rights and Privacy Act, which governs the privacy of student education records. It shapes how schools and universities handle the data their systems hold and expose.

See Education

The EU General Data Protection Regulation, which governs how personal data about people in the EU is processed. Deepinfo processes personal data under the GDPR and Türkiye’s KVKK.

See Privacy Policy · KVKK

The US Health Insurance Portability and Accountability Act, which governs how protected health information is handled. HIPAA is one of the frameworks Deepinfo classifies EASM issues against.

See Healthcare

Registering a domain with characters from another script that render like the Latin letters of a real brand, so the fake name reads as the real one. Internationalized domain names make this possible. The confusable match types in Fraudulent Domain Monitoring exist to find these domains.

See Confusable match · Fraudulent Domain Monitoring

A threat actor who breaks into organizations and sells that access to other criminals, often ransomware operators, instead of carrying out the attack. Access listings on criminal forums can be an early sign that an organization is being targeted.

See Ransomware exposure monitoring

The process of detecting, investigating, containing and recovering from a security incident. IR teams work from defined playbooks and record lessons learned so an incident is not repeated.

See Incident investigation and response

Malware that harvests saved credentials, session cookies, autofill data and system details from an infected device and sends them to its operator, who uses or sells the resulting logs. One infected laptop can expose all the accounts its user signed into. Compromised Employee Device Monitoring reads infostealer logs for devices tied to your organization.

See Compromised Employee Device Monitoring · Credential exposure management

An observable piece of data, such as a domain, an IP address, a file hash or a certificate fingerprint, that points to malicious activity. Analysts use IOCs to hunt through their own logs and to block known malicious infrastructure.

See Threat hunting · STIX/TAXII

The numeric address of a device or service on a network. IPv4 addresses are 32 bits long and written like 192.0.2.10; IPv6 addresses are 128 bits long, which gives the protocol a far larger address space.

See Reverse IP API · IP WHOIS API

Deepinfo’s model for tracking an issue through its states: newly_detected, reappeared, unresolved, marked_as_resolved, verified_resolved, risk_accepted, ignored, marked_as_false_positive and not_applicable.

Instead of a binary open or closed, each state stays on record with its history, which is what an audit trail needs. Every scan sets verified_resolved on its own when the signal is gone, and not_applicable when it cannot tell; your team can mark an issue resolved, accept the risk, ignore it or mark it a false positive. If a resolved signal returns, the issue reopens as reappeared.

See Remediation · Methodology

Short for the CISA Known Exploited Vulnerabilities catalog. See CISA KEV.

See CISA KEV

Türkiye’s Personal Data Protection Law (Kişisel Verilerin Korunması Kanunu), which governs the processing of personal data in Türkiye. Deepinfo processes personal data under KVKK and the EU GDPR.

See Privacy Policy · GDPR

A domain registered to imitate a legitimate one, usually for phishing. Lookalikes use typos, swapped or doubled characters, characters from other scripts and brand names combined with extra words. Fraudulent Domain Monitoring finds them by matching domains against your brand names.

See Fraudulent Domain Monitoring · Phishing detection and prevention

Deepinfo’s service for getting fraudulent content removed, such as a lookalike domain used for phishing. Each request goes to the intermediary that can act on it, such as a registrar or a hosting provider, with the evidence the platform collected, and is tracked until it closes.

See Managed Takedown · Takedown

A service in which an external provider monitors a customer’s environment, detects threats and responds to incidents. MDR combines tooling, threat intelligence and analysts under one contract.

See MSSPs

An organization that runs IT services for its customers, often including security. Deepinfo works with MSPs and MSSPs through its partner program.

See Partners · MSSP

A provider that delivers security operations as a service: monitoring, log management and incident response. MSSPs serve organizations that lack the in-house capacity to run those functions themselves.

See MSSPs

A voluntary framework published by the US National Institute of Standards and Technology. Version 2.0, released in 2024, organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

See Compliance and audit readiness

The Open Worldwide Application Security Project’s list of the most critical web application security risks. Deepinfo classifies EASM issues against the 2021 edition, a reference developers and auditors already know.

See Risk Detection

Historical records of DNS resolutions collected from sensors across the internet. Passive DNS shows what a name resolved to in the past, and which names pointed at an IP address, even after the records changed. Deepinfo’s DNS History API returns the distinct values a record has had, with the times each was observed.

See DNS History API

The second Tuesday of each month, when Microsoft releases its security updates. Many other vendors publish on similar predictable schedules, and security teams plan deployment cycles around them.

See Vulnerability management

The Payment Card Industry Data Security Standard, the compliance framework for organizations that store, process or transmit payment card data. Deepinfo classifies EASM issues against both PCI DSS 4.0 and PCI DSS 3.2.

See Financial services

A prepackaged set of templates, code and setup instructions that lets an attacker stand up a phishing page quickly. Kits usually imitate a specific brand and capture credentials, payment data or authentication tokens.

See Phishing detection and prevention

Moving from one indicator to related ones during an investigation: from a domain to its IP, from the IP to the other domains it hosts, from a registrant email to the domains registered with it. Deep Search & Insights is built around these pivots, each of which is one API call.

See Domain Search · Reverse lookup

A query that starts from an attribute and returns everything that shares it. Reverse IP finds the domains that point to an IP, reverse MX the domains that use a mail server, reverse NS the domains on a name server, and reverse WHOIS the domains registered with an email address.

Reverse lookups drive investigations in Deep Search & Insights and asset discovery in External Attack Surface Management.

See Domain Search · Asset Discovery

Finding every domain that resolves to a given IP address. It reveals related infrastructure and shared hosting, and it is a standard step in asset discovery and investigations. Deepinfo’s Reverse IP API also accepts the /8, /16 or /24 network around an address.

See Reverse IP API

Finding every domain registered with a given registration detail, most often an email address, an organization name or a phone number. It helps uncover subsidiary domains and infrastructure that arrived with an acquisition. Records hidden behind a privacy service cannot be matched this way.

See Reverse WHOIS Email API · Associated Domain Finder API

A formal list of the components, libraries and dependencies inside a piece of software. When a vulnerability is disclosed in a component, an SBOM tells you which products contain it. Some regulations now require one.

See Supply chain security

Internet-facing infrastructure set up by employees, contractors or business units without the security team’s knowledge. Because nobody registered it, shadow IT sits outside the official inventory and outside patching and monitoring.

See Asset Discovery

Software that collects logs from across an organization, correlates events to detect threats and supports compliance reporting. For most security operations centers it is the main working surface.

See SOC teams · SOAR

Tooling that automates security operations workflows through playbooks, such as enriching an alert, opening a ticket or isolating a host. A SOAR platform acts on the data other tools feed it.

See SOC teams

The team and tooling responsible for monitoring, detecting and responding to security incidents. Many security operations centers work around the clock and combine analysts, tooling and defined response procedures.

See SOC teams

The protocols that encrypt data between clients and servers. SSL is the older name; TLS is the protocol in use today for HTTPS, email and other secure channels. A certificate ties a TLS key to the names it is valid for, which also makes certificates a record of an organization’s hostnames.

See SSL Lookup API · Certificate transparency

Structured Threat Information Expression and Trusted Automated Exchange of Intelligence Information, two OASIS standards. STIX describes threat intelligence as structured objects, and TAXII defines how those objects are exchanged between systems.

See IOC

Discovering the subdomains that belong to a parent domain. Techniques include passive DNS, certificate transparency logs, crawling and brute-force probing of likely names. Deepinfo’s Subdomain Finder API returns the subdomains the index holds for a domain.

See Subdomain Finder API · Asset Discovery

An attack that reaches an organization through a trusted supplier, vendor or software dependency instead of attacking it directly. The SolarWinds, Kaseya and 3CX incidents are well-known examples.

See Supply chain security · TPRM

Removing malicious content from the internet by submitting evidence to the intermediary that controls it: a registrar, a hosting provider or a platform. A request works best with complete evidence, sent to the party that can act on it.

See Managed takedown services

An individual or group behind malicious cyber activity. Common categories are state-sponsored groups, criminal organizations, hacktivists and insiders. Deepinfo’s threat actor profiles record each actor’s targets by region, country and industry, and the CVEs and tools the actor uses.

See Threat Actor Intelligence

A proactive search for threats that have evaded existing defenses, usually driven by a hypothesis drawn from threat intelligence. It differs from incident response in that it starts without a known compromise.

See Threat hunting

The practice of assessing and monitoring the security of vendors, suppliers and partners. Deepinfo’s TPRM module applies EASM’s discovery, layer-by-layer scanning and scoring to each third party, so vendors and your own assets sit on one scale.

It adds a continuous, outside-in view to point-in-time questionnaires.

See Third-Party Risk Management

A way of describing how a threat actor operates. Tactics are the goal, techniques are how the actor reaches it, and procedures are the specific implementation. MITRE ATT&CK is the most widely used catalog of techniques.

See ATT&CK

Registering domains that exploit common typing mistakes, such as acmebnak.example registered to catch visitors meant for acmebank.example. Typosquats are used for phishing, malware delivery and ad fraud.

See Fraudulent Domain Monitoring · Lookalike domain

Evaluating a vendor’s security posture before and during a business relationship. Traditional assessments rely on questionnaires; continuous monitoring of the vendor’s external attack surface shows whether the answers still hold.

See Vendor Risk Assessments · Third-party risk management

The consortium’s threat classification is a taxonomy of web application attacks and weaknesses. It is one of the frameworks Deepinfo classifies EASM issues against.

See Risk Detection

The protocol and records that describe a domain’s registration: registrar, registration and expiry dates, name servers, status codes and, where published, the registrant. Much registrant data is now redacted or proxied for privacy, and where it is hidden, it stays hidden in Deepinfo’s data.

The WHOIS Lookup API returns the current record, raw and parsed, and the WHOIS History API returns the records a domain has had before.

See WHOIS Lookup API · WHOIS History API

A vulnerability that attackers exploit before a fix is available, which leaves the vendor zero days to respond. Zero-days are usually reserved for high-value targets. Once one has a CVE ID, confirmed exploitation and remediation guidance, it qualifies for CISA KEV.

See Vulnerability management · CISA KEV