Talk to us

Select your region.

Choose where your workspace is hosted.

Africa(opens in a new tab)

Need help? Contact us.

Cyber Risk ManagementKnow your exposure.

DarkRisk measures cyber risk from the outside in: your own attack surface and every vendor’s, dark web and media exposure, and questionnaires checked against what a scan can see.

Talk to us Check a domain, free
Attack surfaceIP and ASN scanningDark web intelligenceMedia monitoringFourth partiesQuestionnaires

What DarkRisk checks

  1. Application: The part everyone sees.

    Every website sends back headers, sets cookies and exposes pages that were never meant to be found. These are the first things anyone tests.

    • Security headers
    • Session cookies
    • Exposed admin pages

  2. Platform: What it is built on.

    Servers, frameworks and libraries are fingerprinted from the outside and matched against published vulnerabilities.

    • Known vulnerabilities
    • End-of-life platforms
    • Version disclosure

  3. Encryption: How data travels.

    Certificates, protocols and ciphers decide whether traffic between people and a service can be read or tampered with.

    • Certificate expiry
    • Legacy TLS versions
    • Weak ciphers

  4. Network: What is listening.

    Every domain, IP range and ASN is checked for open ports and exposed services. Remote access and databases should never be reachable.

    • Remote access ports
    • Reachable databases
    • Unencrypted services

  5. Cloud: Where it runs.

    Hosting, storage and managed services. A single public setting can expose everything stored behind it.

    • Public storage
    • Exposed consoles

  6. Domain: Who it claims to be.

    DNS and email records prove identity. Weak policies and lookalike domains let someone else speak in a company's name.

    • DMARC policy
    • DNSSEC
    • Lookalike domains

  7. Dark web and media: Beyond the stack.

    Dark web intelligence picks up when a company is claimed as a breach victim, by whom, and roughly what was taken, including when one of its own suppliers was hit. Press coverage is followed by region, with breach reporting flagged.

    • Claimed as a breach victim
    • Fourth party implicated
    • Breach-related coverage
    • Mentions by region

Cyber Risk Management.One connected view.

Your attack surface and every vendor’s, the dark web, the press, the companies behind your vendors and the answers they give you. One record, kept current. Explore the Cyber Risk Management platform

Attack surface

Domains, IP ranges and ASNs, checked across six layers and graded A to F.

Dark web and media

Breaches at your vendors and their fourth parties, and what the press is saying.

Fourth parties

Who your vendors share your data with, and where those paths meet.

Questionnaires

Answers with their evidence, checked against what a scan can see.

What they say.What we see.

A questionnaire tells you a vendor's policy. A scan tells you what is actually exposed. With both in one record, the gap between them is impossible to miss. Move over or tap the answers to look underneath.

3of 4 answers don’t match what can be seen from the outside.

  1. Is multi-factor authentication required for remote access? The vendor answered: Yes, for all remote access. The scan shows: Remote desktop reachable from the internet. No MFA challenge before the sign-in prompt.
  2. How quickly are critical vulnerabilities patched? The vendor answered: Within 7 days of release. The scan shows: Running a release with published CVEs. Fixed version available for over a year.
  3. Is your domain protected against email spoofing? The vendor answered: Yes. SPF, DKIM and DMARC. The scan shows: Policy set to p=none. Forged mail is reported, not rejected.
  4. Is TLS 1.2 or later enforced for all services? The vendor answered: Yes. The scan shows: TLS 1.2 and 1.3 only. Consistent with the answer.

Illustrative data for a fictional vendor.

Try it onany domain.

Free tools built on the same checks DarkRisk runs on every vendor. Start with email and DNS security: seven checks, live, on your own domain or a supplier you’ve been meaning to ask about.

Check a domain All tools