VesperID maps, every day, what the outside world knows about you and hands you every exposure qualified, dated and tied to an asset.VesperID maps, every day, what the outside world knows about you, from closed forums to information-stealer logs, and hands you every exposure qualified, dated and tied to an asset: credentials, infected devices, lookalike domains, executives, suppliers.
Three things leak past the perimeter: access, a brand, people.
Your tools protect the inside. VesperID watches the outside, where an attacker prepares a way in: leaks at third parties, domains registered by others, the traces your executives leave behind.
01
Access
A work address and its password surface in a breach or in an information stealer’s log. The session cookie of an infected device replays a login with no second factor.
A domain that imitates yours obtains a certificate, copies your login page, then launches a campaign. Elsewhere, a public repository or a forum exposes a secret or an access for sale.
An executive also exists outside the company: personal accounts, personal devices, addresses, close circle. What circulates about them is used to impersonate or reach them.
What you get: a dated score, the open findings ranked by severity and, for each one, the expected action.
OverviewFictional data
Exposure score
38
Open findings148
Open critical9
Monitored assets212
Replayable session2 h
Exposed credential4 h
Lookalike domain registered19 h
Forum mention4 j
Large screen · 1440
OverviewFictional data
Exposure score
38
Open findings148
Open critical9
Monitored assets212
Replayable session2 h
Exposed credential4 h
Lookalike domain registered19 h
Phone · 390
The same overview, on a large screen and on a phone.Fictional data
Available on desktop and mobile
The same client area, on your desk and in your pocket.
The client area installs from the browser, in one tap, with no app store involved. Same account, same rights, same security on every device; updates are automatic.
Desktop applicationWindows, macOS, Linux
Installed from the browser, in its own window
Desktop notifications at the severity threshold you set
Automatic updates, nothing to reinstall
Session code lock
Mobile applicationiPhone, iPad, Android
Installed in one tap from the browser, no app store
Phone notifications, with the same thresholds
Automatic updates, nothing to reinstall
Session code lock every time you come back
03Where the information comes from
Three collection channels, one platform that ties them together.
Specialised partners infiltrate cybercriminal networks and acquire leaks as soon as they circulate; the open web is crawled continuously. VesperID ties those three feeds to your perimeter.
Specialised analysts follow cybercriminal forums, marketplaces and messaging channels, closed spaces included, and the actors who sell access, data and kits there.
Forums and sections reserved for vetted members
Marketplaces for access, data, cards and kits
Messaging channels of groups and their brokers
02Collection partners
Leak acquisition
Leaked databases and information-stealer logs are acquired and indexed as soon as they circulate, with the metadata that ties each exposure to an identity and a date.
Leaked databases and combolists
Stealer logs: credentials, cookies, saved forms
Several years of searchable history
03Continuous collection
Open web and dark web
Ransomware leak sites, pastes, public repositories, exposed buckets, social networks, certificate logs, domain registrations and the exposed surface, crawled continuously.
Ransomware leak and claim sites
Certificate transparency logs and domain registries
Hosts, ports and services visible from the internet
VesperID platform and analysts
Correlation
One identity, one infected device and one valid session make one incident, not three alerts.
Explained scores
Freshness, nature of the data, criticality of the asset, validity of the access: the factors are readable.
Every aggregated account gets a score and a recommended action: awareness, device to reinstall, access to harden. A security aid, never an HR tool.
Analysts within reach
Alerts go out automatically according to your rules; an analyst qualifies a case at your request and handles investigations, takedowns and reports.
Board reports
Every detection keeps its source and its date; the monthly report consolidates them for leadership.
04Fifteen services, six families
Compose the monitoring your exposure calls for.
Thirteen services watch the map, two cross analyses relate what they see, all of them feed the same client area. Every licence is a named composition of services, each with its own price: you activate only the ones that concern you.
One hour with an analyst to set the perimeter, the priorities and who receives the alerts. You get a written proposal, line by line.
Day 1 to 7
Monitoring set-up
You declare domains, addresses, people and keywords; every domain is verified through a DNS record. The available history is pulled in immediately, and the client area installs on desktop and mobile.
Continuously
Qualification
The platform collects, correlates, scores every finding and sends it to your channels with the expected action, according to your rules. An analyst qualifies a case at your request.
Every month
Report
A posture report leadership can read: score, trends, closed and open findings, recommendations for the month ahead.
Step 2Day 1
Fictional data
societe.exampleVerified by DNS
sso.societe.exampleVerified by DNS
vpn.societe.exampleVerified by DNS
mail.societe.examplePending
portail-rh.societe.examplePending
History pulled in, per quarter12 quarters
350
35
20232026
3 years of history pulled in
What you get: a perimeter proven through DNS, never an agent, and the available history from day one.
Step 3Qualified
Fictional data
Exposed credentialCritical
j.d••••@societe.exampleStealer log
Scored, expected actionReset the access and revoke open sessions
Source
Stealer log
Detected
4 min ago
Target
24 h
Status
Qualified
Collected10:42
Correlated with the perimeter10:43
Scored and prioritised by your rules11:05
Sent to your channels11:06
E-mail
Slack
Teams
Webhook
What you get: a finding that is dated, scored, carries the expected action, and is sent to your channels.
06What you receive
Four deliverables, from day one to month twelve.
Nothing to install, nothing to administer: monitoring lands in your channels, the status in a dated document.
01
Qualified alerts
By email, Slack, Teams or webhook, at the severity threshold you set per channel, with the expected action.
02
A client area
The findings inbox, the perimeter, the team, the exports and the full history, isolated per organisation.
03
A monthly report
Score, trends, closed and open actions, in a dated document your board and your auditor can read.
04
A reachable analyst
The person who qualified your alert answers your questions and scopes perimeter extensions.
07Two perimeters
An organisation, or a person.
Two perimeters, one catalogue: a company’s, made of domains and assets, and a person’s, made of accounts and identities. Every licence is composed service by service, and an organisation can hold several.
Enterprises
CISOs, IT directors, risk management, legal counsel
Domains, work addresses, brands, suppliers and public IP addresses, monitored continuously and tied to your assets.
Compromised credentials and devices tied to your domains
Executives, family shareholders, public figures and their close circle
One exposure profile per person: private accounts and addresses, personal devices, impersonation, personal data being resold. The person accepts the invitation themselves, has a single point of contact and alone decides who sees their profile, even when their company pays.
Personal and professional accounts exposed in leaks
There is no public price because there is no standard offering: every licence is a composition of services, each with its own price, and the amount follows the monitored perimeter, the services activated and the level of support. After a one-hour scoping call, you receive a written proposal, itemised line by line, for an annual engagement.
Do we have to install anything?
No. No agent, no probe, no access to your systems. You declare a perimeter and prove ownership of your domains through a DNS record; everything is observed from the outside.
Who operates the platform that holds our data?
VesperID, a French cybersecurity company subject to the GDPR, builds and operates its own platform, in a space isolated per organisation; the data protection officer can be reached at dpo@vesperid.com.
Do you keep the passwords you find?
No. Neither the value of a password, nor the hash supplied by the source, nor the value of a cookie is stored. You see the metadata a decision needs; viewing a sensitive item happens on demand, for an account of your verified perimeter, after re-authentication, with a reason, and it is logged.
How is this different from our SOC or our EDR?
They protect the inside of your systems. VesperID looks outside: leaks at third parties, infected personal devices, domains registered by others, forums. Our alerts land in the channels your SOC already uses.
When do we see the first results?
As soon as an asset is verified: the available history is pulled in immediately, and that is often where the first findings are. After that, the pace depends on your actual exposure; some weeks are empty, and that is good news.
Which devices does the application run on?
On desktop (Windows, macOS, Linux) and on mobile (iPhone, iPad, Android). The client area installs from the browser, in one tap, with no app store involved, and updates itself automatically. The account, the rights and the security are the same on every device: two-factor authentication, session code lock, audit log.
Request an exposure assessment.
One hour with an analyst, not a demo: what already circulates about your organisation, what to monitor, what is better left alone. Reply within one working day.