What we cover

What we see from outside, and what we never see.

Every way a firm can be impersonated, entered, emptied or embarrassed that we know of, grouped by what the attacker is doing. For each one: how it is used against a firm, and how we see it. The last section lists what an outside reading does not show.

Check my firm How it works

No loginNo installNo mailbox accessOne dated record

Someone pretends to be the firm

The attacker writes to the firm's clients, suppliers or staff as the firm. This is where the money is lost: a client pays a forged invoice, a supplier changes bank details, staff follow a fake partner's instruction.

The exposure	How it is used against a firm	How we see it
Email can be sent in the firm's own name (no DMARC record, or one set to take no action)	A forged email from the real address: new bank details, an urgent payment from the payments department or the managing partner	We read the record, quote it, and give the exact steps to close it. Re-checked every hour on monitoring.
DMARC set to send forgeries to spam, not refuse them	Forgeries land in junk, where staff and clients still find and trust them	Listed as partly closed, with the step to finish.
A look-alike of the firm's domain registered: one letter changed, a different ending, a hyphen	An email from a copy of the firm's name, as the partner, the accounts team or the lawyer on the file	Up to 300 variations of the name checked; registered ones listed with the date. New ones looked for every hour on monitoring.
A look-alike that is set up to send or receive email	The copy is ready to be used, not just parked	We read its mail records, and it is graded higher.
A look-alike website copying the firm's pages	A fake login page or a fake "update your payment details" page	We compare the copy's content with the firm's own site.
A firm address pointing at a service the firm cancelled	Someone claims the old service and runs a page at that address, under the firm's own name	A dedicated check on every firm host name we find.
A service that sends email for the firm (billing, newsletters, client systems) that the firm's rules do not cover	Mail "from the firm" through that service is not refused	Each sending service the records reveal, and whether forged mail through it would be refused.

Someone pretends to be someone the firm trusts

Email arriving at the firm from a look-alike of a supplier, a client or the bank. Our checks protect the firm's own name. We do not read the firm's inbox.

The exposure	How it is used against a firm	How we see it
Email arriving from a look-alike of the firm's own name	Staff get "the managing partner" from a one-letter-off copy of their own domain	The same look-alike check: the copy is found when it is registered.
Email arriving from a look-alike of a supplier's or client's domain	A supplier's "new bank details" from a copy of the supplier's domain	Supplier watch, on monitoring: look-alikes of up to five suppliers or clients the firm names. Read every hour on monitoring.
Staff addresses the firm publishes on its website	Phishers know exactly whom to write to, and those addresses end up in breaches	We find the addresses the firm publishes and check each one in monitored breach databases.

Getting in

Doors an attacker uses to get inside: the start of ransomware, data theft and account takeover.

The exposure	How it is used against a firm	How we see it
Remote access answering on the internet (RDP, SMB, Telnet)	The classic ransomware door	A port check on the website host, www, and up to six of the firm's own other host names.
Other services answering: databases, file transfer, admin panels	Guessing passwords, known flaws	The same port check, with what each service announces about itself.
Website and server software with a known, published flaw	A published flaw is a door anyone can look up	Website software, its scripts and server banners, wherever they announce their version.
Outdated scripts on the website	Code in the visitor's browser can be hijacked	A check for script libraries with known flaws.
Admin, debug or configuration pages open without a login	A settings file or control panel anyone can open	A check for exposed pages and settings files.
Secrets or keys left in website code or public code repositories	A password or key copied straight out	Website code and public code search.
A WordPress site listing its user names	Half of every login pair handed over	A dedicated check.
Missing browser security settings, a weak certificate	Mostly tidy-up	The certificate and five browser settings, listed as settings to tidy, not as ways in.

Data walking out

Client files, invoices, IDs and bank details. Often used months or years later, against the firm's clients, and rarely traced back.

The exposure	How it is used against a firm	How we see it
Cloud storage folders named after the firm, readable by anyone	Client files downloaded without anyone knowing	We check the main cloud storage services for storage named after the firm.
Documents indexed by search engines that should not be	Contracts, invoices, staff lists found by a search	A targeted search for the firm's exposed documents.
Old pages still archived: an old staff list, an old client portal	History an attacker can mine	Archive history.
Firm addresses leaked in someone else's breach	Firm addresses and passwords in a breach the firm never heard about	Every firm address we find, checked in monitored breach databases.

Accounts taken over

One staff password is often all it takes.

The exposure	How it is used against a firm	How we see it
Firm addresses listed in monitored breach databases	Old passwords reused; the attacker signs in as staff	Every firm address we can find, counted as an open way in.
A former employee's address in breach data	Nobody watches that inbox, and the old password may still work	Breach listing of every firm address. Whether the account is still switched on is inside the firm (section 9).

Trust in the firm's name

Things that make the firm look compromised, or stop its mail arriving.

The exposure	How it is used against a firm	How we see it
The firm's server or domain on a spam block list	The firm's own invoices go to junk, often a sign it was used to send spam	A block list check.
The firm's site flagged for hosting malware or phishing	Visitors warned away; it usually means the site was hacked	Malware and phishing databases, and reputation services.
Sharing a server with known bad sites	Blocked along with them	Shared hosting neighbours.
Domain or certificate about to expire	The site goes down, or the domain lapses and someone else buys it, with the firm's email	Expiry dates.

Change at the firm

Every change is a chance for a door to open. Most changes are harmless; nobody knows which one was not without looking again.

The exposure	How it is used against a firm	How we see it
Moving to a new email provider	The anti-forgery record lost or reset, and a firm that was closed is open again	Re-checked every hour on monitoring.
Moving website host, DNS host or registrar	Records rebuilt by hand, some forgotten	Mail records: re-checked every hour on monitoring. The rest re-read every day.
Website rebuilt or redesigned	Settings gone, test pages live, settings files readable, old plugins	Headers, exposed files, pages and scripts, re-read every day on monitoring.
A new website plugin or script added, or one not updated	A published flaw in the version installed	Website software and scripts, re-read every day on monitoring.
A new host name: a portal, a booking page, remote access	A new login page or service online	New names spotted in public certificate records every hour on monitoring. Ports checked on them.
A service cancelled, its address left behind	Someone takes over the address under the firm's name	A takeover check on every firm host name we find.
A new service sending email for the firm	Mail sent through it in the firm's name is not covered by the firm's rules	Every sending service the records reveal, and whether forged mail through it would be refused.
A new employee	Their address is published, then turns up in a breach	Breach listing of firm addresses, re-checked on monitoring.
An employee leaves	Their address turns up in a breach while nobody watches the inbox	Breach listing of firm addresses, re-checked on monitoring.
Staff set something up without telling the owner: a newsletter, a booking tool	A new sender or host name nobody approved	The new record or host name appears in what we read.

The world changes, even when you do nothing

Three clocks run without asking the firm: new flaws, new breaches, new attackers.

The exposure	How it is used against a firm	How we see it
A new flaw published in website or server software the firm already runs	Safe on Monday, open on Thursday	Re-read every day on monitoring.
An old breach surfaces years later	Firm addresses appear in breach data long after the event	Monitoring re-checks breach listings.
Someone registers a copy of the firm's name tomorrow	A new look-alike appears	New ones looked for every hour on monitoring.
Attack tools get cheaper	The same checks run against thousands of firms at once	We keep reading on a schedule: email settings, look-alikes and new host names re-checked every hour, the rest every day.

What we never see

These are real risks inside a firm. An outside reading does not show them. We list them here so you know where our reading stops.

Your own team can check several of them on the inside checklist, recorded with the date.

Not seenLaptops, phones and office software: what is installed, and whether it is updated
Not seenStaff clicking a phishing link
Not seenPasswords in use, and whether a second sign-in step is on
Not seenBackups
Not seenWho has admin rights
Not seenEmail arriving in the inbox
Not seenWhether a former employee's account is still switched on
Not seenA supplier's or client's own security
Not seenAn urgent request from a personal email account pretending to be a partner
Not seenPhone and text fraud

How the inside checklist works.

Check my firm

See what your firm shows the internet, without handing over a key.

Your domain and a work email at it. No password, no login and no software. Read-only, and sent only to your work email.

Check my firm