Why real time matters
The window
The value of this platform is not the old findings. It is the time you gain when something new turns up.
A password from a leak years ago. Often changed long since, rarely dangerous. That is what the first scan shows you — and it is the smaller part.
A record that turns up on a darknet marketplace today: with passwords that are frequently still valid and often an employee's session cookies. Here hours count — which is why we report a new finding like this at once.
-
A computer gets infected
An employee opens an attachment or installs a program. Malware, a so-called infostealer, copies in seconds what the browser has saved: passwords — and the session cookies.
-
The data is up for sale
Soon afterwards the package sits on a darknet marketplace. It costs a few dollars.
-
24–48hours
The window
That is how long it usually takes until a buyer uses the data. This is where we come in: a new log for your domain reaches us in real time, and we report it at once, at best while you can still turn the attack away.
-
Access without a second factor
With the session cookie the attacker takes over a session that is already signed in, for as long as it is valid. The two-factor prompt never comes.
-
From the account into the company network
From the Microsoft account over Active Directory to e-mail, files and servers. Or straight into the company network through Citrix or VPN.
-
Ransomware
Often your data is copied first, then everything is encrypted.
Operations stand still until the systems are restored. A good backup helps here — after days.
A backup helpsCustomer data, contracts, payrolls — copied before the encryption, then published or sold. No backup helps against that: reporting duties, lost trust and liability can follow.
No backup helps«I have a good backup — ransomware is not critical for me.»
The backup brings the systems back. It does not bring back the data that was copied first — and that is often the bigger damage.
- New stealer logs for your domains reach us in real time; the rest of the data we cover is checked against your domains every day, not just once a month.
- If a new high or critical finding about your company turns up, we get in touch at once: by e-mail and, if set up, as a message to your phone. Everything else is bundled in the weekly report.
- You replace the password, then revoke the account's sessions and clean the device; with the Corporate plan and above, the application takes over the first two steps for cloud-only accounts, through emergency access that you set up. That makes the stolen access worthless before anyone uses it.
That is why the first scan is only the beginning. The value comes on every day after it.