NewAI pentesting that proves every finding
INSECUREWEB

Monitoring

Threat Intelligence

Add a domain and InsecureWeb maps everything of yours reachable from the internet: subdomains, IP addresses, open ports and services, certificates, technologies and exposed employees. Each item is checked against threat intelligence feeds and known vulnerabilities, and every domain gets a risk score from 0 to 100.

Start freeSee pricing

Attack surface of woodgrovebank.com

84/100

Assets found
214
In a threat feed
3
Vulnerable or expired
2
An illustration with a fictional company. Names and numbers are invented.

  • First map within the hour

    Subdomains, hosts, DNS records, IP addresses, ports and services, certificates and technologies.

  • A risk score per domain

    From 0 to 100, set by the threat-feed verdict and raised by open vulnerabilities.

  • The people you expose

    Employees discovered on your surface, with whether their credentials appear in breaches.

  • Feeds for your firewall

    Download blocklists of malicious IPs, domains, hostnames and malware hashes every day.

Walk your surface, view by view

Each organization opens as a list, a hybrid view or a galaxy graph of its root domains, subdomains, IPs, services, people, threats and vulnerabilities. Eleven views break it down — vulnerabilities with EPSS scores, threat matches, activity over time, people, hosts, DNS records, IP addresses, ports and services, certificates, technologies and identity.

  • What changed and when — added, modified, removed, with old and new values
  • Expired or mismatched certificates flagged
  • Export the whole surface as a PDF

Investigate any indicator

The investigation workspace, powered by ThreatWinds, looks up URLs, IP addresses, domains and file signatures across tens of millions of known indicators.

Block what is already known to be bad

Download cumulative blocklists — blacklisted IPs, malicious domains, malicious hostnames and malware hashes (MD5 and SHA-256) — with ready commands in Bash, Python and PowerShell. Guides cover Suricata, Cisco, Fortinet and Wazuh, and any tool that reads a plain-text blocklist can use them.

Where new findings are sent

Webhook retries
Up to 10
Records per request
10,000
Blocklists updated
Daily
An illustration. Feed guides cover Suricata, Cisco, Fortinet and Wazuh.

Questions about Threat Intelligence

What is an attack surface?

Everything an organization has that can be reached from the internet — websites, subdomains, servers, open services, certificates and the people whose details are public — and so everything an attacker can look at first.

How is the risk score worked out?

The threat-feed verdict sets the band — high risk starts at 80, elevated at 45, clean at 10 — and each open vulnerability adds 2 points, up to 20. An organization takes the score of its riskiest domain.

Which firewalls and SIEM tools can use the feeds?

The app has guides for Suricata, Cisco, Fortinet and Wazuh. The lists are plain text, so any product that reads a blocklist can use them.

How soon do I see results?

The first map of a new domain is ready within the hour.

Works well with

Further reading

Find out what an attacker would find first

Create a free account, add your domain and see your leaked credentials, lookalike domains and exposed services. No card required.

Start freeTalk to sales