Every change at your firm can open a door.
Most changes are harmless. Nobody knows which one was not without looking again. Three clocks run without asking the firm: the firm itself, the world, and the attacker's tools.
An assessment is a photo of one date.
Monitoring is the film. Your outside changes after that date. On monitoring the same checks run again, email settings, look-alikes and new host names every hour and everything else every day, and each change found is recorded with its date.
What changes, and what we re-check.
| The change | What can open | What we re-check |
|---|---|---|
| Moving to a new email provider | The anti-forgery record lost or reset, and a firm that was closed is open again | Re-checked every hour on monitoring. |
| Moving website host, DNS host or registrar | Records rebuilt by hand, some forgotten | Mail records: re-checked every hour on monitoring. The rest re-read every day. |
| Website rebuilt or redesigned | Settings gone, test pages live, settings files readable, old plugins | Headers, exposed files, pages and scripts, re-read every day on monitoring. |
| A new website plugin or script added, or one not updated | A published flaw in the version installed | Website software and scripts, re-read every day on monitoring. |
| A new host name: a portal, a booking page, remote access | A new login page or service online | New names spotted in public certificate records every hour on monitoring. Ports checked on them. |
| A service cancelled, its address left behind | Someone takes over the address under the firm's name | A takeover check on every firm host name we find. |
| A new service sending email for the firm | Mail sent through it in the firm's name is not covered by the firm's rules | Every sending service the records reveal, and whether forged mail through it would be refused. |
| A new employee | Their address is published, then turns up in a breach | Breach listing of firm addresses, re-checked on monitoring. |
| An employee leaves | Their address turns up in a breach while nobody watches the inbox | Breach listing of firm addresses, re-checked on monitoring. |
| Staff set something up without telling the owner: a newsletter, a booking tool | A new sender or host name nobody approved | The new record or host name appears in what we read. |
Even when the firm does nothing.
| What happens | What it means | What we re-check |
|---|---|---|
| A new flaw published in website or server software the firm already runs | Safe on Monday, open on Thursday | Re-read every day on monitoring. |
| An old breach surfaces years later | Firm addresses appear in breach data long after the event | Monitoring re-checks breach listings. |
| Someone registers a copy of the firm's name tomorrow | A new look-alike appears | New ones looked for every hour on monitoring. |
| Attack tools get cheaper | The same checks run against thousands of firms at once | We keep reading on a schedule: email settings, look-alikes and new host names re-checked every hour, the rest every day. |
The exact fix, re-checked until closed.
Each fix comes as exact steps, in order, with the check that proves it is done. We re-check it from outside when you mark it done, every day through your first month of monitoring, and every week after that until our re-check confirms it closed. Where a finding cannot be confirmed from outside, your assessment says so on that finding and records your confirmation.
We read changes from outside.
- NoWe do not ask you to tell us about a change. We read it from outside.
- NoWe do not see changes inside your firm: new laptops, new accounts, new passwords, new admin rights.
- NoNo login, no install, no mailbox access.
See what your firm shows the internet, without handing over a key.
Your domain and a work email at it. No password, no login and no software. Read-only, and sent only to your work email.