The platform
One workspace to see, connect and act.
A score and its trend, a qualified inbox, cross analyses, exposure chains, the accounts to protect, playbooks, alerts and an API. No agent. A score and its trend, a qualified inbox, cross analyses on every identity, device, domain and supplier, exposure chains, the list of accounts to protect, playbooks, alerts on your channels and an API. All of it run by a French cybersecurity company, with no agent and no password or cookie kept.
In one sentence
The VesperID platform is the client area where every signal collected by our partners and by our continuous collection is tied to an asset of your perimeter, scored, linked to the others and turned into an expected action, with a record of who did what; our analysts handle investigations, takedowns and reports there.
Overview
A score, its trend, and what changed since your last visit.
The exposure score runs from 0 to 100 and is recomputed at every synchronisation; its curve covers the last 90 days, about twelve weeks. Every time you come back, the platform shows the findings that appeared, the ones resolved and how the score moved since your last visit.
What you get: a dated score and its curve, the open findings ranked by severity and, every time you come back, the list of what moved.
- 01
Score from 0 to 100
Recomputed at every synchronisation from the open findings, their severity, their freshness and the criticality of the assets touched.
- 02
90-day trend
The score, open findings, critical ones and monitored assets over the last 90 days, so you read a trajectory rather than a snapshot.
- 03
Since your last visit
New findings, resolved findings and score variation since the date of your last visit, recorded per account.
- 04
Qualified inbox
Every finding carries a status, a severity, its source, its date and the expected action; you assign it to a team member, ignore it with a reason, close it.
Cross analyses
Every entity is analysed, not just listed.
Identities, devices, sessions, lookalike domains, executives, suppliers, exposed surface: for each one the platform crosses what the monitoring services saw and derives a score, a class and readable reasons.
What you get: for every identity, device, domain or supplier, a score, a class and the reasons behind them.
- 01
Identity: risk and takeover
A risk score per identity, with its reasons, and a takeover class (possible, likely, immediate, or none) drawn from usable passwords, infected devices and still-valid corporate cookies.
- 02
Device: criticality and timeline
A criticality score per infected device, from the corporate services touched, the loot captured and the user, with the infection timeline.
- 03
Session: validity and targeted hosts
For every stolen session, whether it is still valid and which hosts of your organisation it opens.
- 04
Lookalike domain: phishing readiness
An index built from the mail server, the certificate, the active page, SPF and the registration date, and a four-state classification: unclassified, legitimate, monitored, malicious.
- 05
Executive: exposure profile
Six exposure families per monitored person, once they have accepted the invitation themselves: credentials, personal data, doxxing, impersonation, devices, mentions.
- 06
Supplier: ransomware exposure
An index per supplier and across the portfolio, from leak-site listings and the accounts exposed on their side.
- 07
Surface: drift
The hosts and ports that appear, change or disappear from one synchronisation to the next, and the certificates about to expire.
- 08
Priorities
A queue ranked by severity, freshness, asset criticality and target handling time: from 4 hours to 90 days by default depending on severity, adjustable.
Exposure chains
Where an exposure comes from, and what it enables.
A graph links devices, credentials, sessions, lookalike domains, exposed hosts, executives, suppliers and breach sources. Every chain carries a probable origin, a confidence, the possible impacts and the recommended playbook; findings show what they are linked to.
Discover the Exposure chains serviceWhat you get: the whole chain, its probable origin, its impacts and the action that cuts it.
- 01
Relations, not lists
Infected device, leaked credentials, valid session, SSO access; lookalike domain registered shortly before a wave of leaks; supplier breach exposing your accounts; exposed service with usable credentials.
- 02
Probable origin and confidence
Infected workstation, third-party breach, password reuse, phishing campaign, supplier compromise or exposed service, with the confidence level of that reading.
- 03
Possible impacts
Account takeover, session replay, SSO, VPN or mailbox access, executive impersonation, lateral movement, exfiltration: what the chain enables if nobody acts.
- 04
Recommended playbook, kept current
Every chain names the playbook to run; chains are recomputed every fifteen minutes and, after an action recorded on an account, within minutes.
Exposed staff
Which accounts to reset, which devices to reinstall, which access to harden.
A security aid, never an HR tool. Every account of your domains is aggregated: leaks, usable passwords, stealer logs, live sessions, distinct sources, exposed personal data, suspected password reuse. Out of it come a probable role inferred from your perimeter, an exposure score and a single recommended action; nothing is inferred about private life.
Discover the Exposed staff serviceA limit stated plainly · Our data does not say whether MFA is on: “access to harden” means a usable password is circulating for a sensitive target with no proof of a second factor.
What you get: the list of accounts to reset, devices to reinstall and access to harden, with a score and a reason for each.
- 01
One recommended action per account
Phishing awareness training, password hygiene, device reinstall and rotation, access hardening with MFA, session revocation, executive protection, or plain monitoring.
- 02
Five cohorts
Awareness recommended, device to reinstall, access to harden, to watch, no exposure. A notification goes out when an account enters a cohort to protect.
- 03
Recorded actions
Briefed, device reinstalled, access hardened, sessions revoked: every recorded action lowers the score, and a new exposure flags the account again.
- 04
Export for the security team
The list of exposed accounts and the recommended action exports for the security team, to organise resets, reinstalls and awareness sessions.
Playbooks
Fourteen playbooks, one expected action per case.
Device isolation, credential reset, lookalike response, supplier questionnaire, exposure hardening, card exposure, bank account exposure, triage: every playbook lists the steps, the accounts to reset and the sessions to revoke, and names the expected action shown on the finding.
What you get: for every case, the course of action, written and ordered, never a bare notification.
- 01
Steps, in order
Every playbook runs its steps in the order in which they cut the exposure: first what closes the access, then what documents it.
- 02
Tied to chains and priorities
An exposure chain, a priority or a recommended action on an account always points to the playbook to run.
- 03
One expected action per finding
The playbook named shows on the finding and in the alert; at your request, an analyst adapts it to your context.
Alerts, exports and API
Your channels, your formats, your tooling.
Alert rules send what you choose to e-mail, Slack, Teams or a webhook, in real time or as a digest, with quiet hours; the client area updates live; findings export to CSV and JSON; an API documented in OpenAPI plugs VesperID into your SIEM, your ticketing or your scripts.
What you get: the alert where your team already works, and your data in your tools.
- 01
Alert rules
By severity, by service or by event, to one or several channels: e-mail, Slack, Teams, webhook. In real time or as a daily or weekly digest, with quiet hours.
- 02
Live updates
A finding changing status, a recomputed score, an updated chain show up without reloading the page.
- 03
CSV and JSON exports
Findings export to CSV and JSON, with the view’s filters; the list of exposed accounts to CSV, for the security team.
- 04
Documented API
The same data as the client area, under an OpenAPI specification, with stable operation ids for your integrations.
Team, journal and GDPR
Clear roles and a record of every step.
Four roles (owner, manager, analyst, viewer), an audit journal recording who assigned, revealed, exported or changed what, and GDPR export or erasure requests handled in the application, with their status.
What you get: a team with the right rights and, for your auditors, the record of every step.
- 01
Four roles
The owner administers, the manager runs the team and the settings, the analyst handles findings, the viewer reads.
- 02
Audit journal
Every sensitive action is dated and attributed: sign-in, secret reveal, export, role change, GDPR request.
- 03
GDPR requests
Export or erasure of an account’s data, requested and tracked in the client area, handled by our teams within the statutory month.
Account and secret security
No secret stored, a reveal on demand, under journal.
Stolen passwords, cookies and full card numbers are never kept at VesperID. When an authorised member needs to see the value of an account in your verified perimeter, they request it with a reason: it is read live after re-authentication, shown for the time of the check and recorded in the journal, within a limit of twenty reveals per person per day; the value of a third-party service’s cookie is never revealed.
What you get: the value when it is needed, never a copy sleeping in a database.
- 01
MFA on accounts
Second factor through an authenticator application: mandatory for owners and managers, available to every member, and the organisation can impose it on everyone.
- 02
Session code lock
On desktop as on mobile, the application locks and asks for a code every time you come back.
- 03
French company, per-client isolation
A platform run by a French cybersecurity company, one isolated space per organisation, enforced in the database itself, encryption keys managed in a dedicated service, separate from the database.
Managed services
Takedowns, investigations and reports, tracked in the same place.
A takedown is requested from the finding and tracked with its credits and its deadline; an investigation moves forward in a journal shared with the analyst; the monthly posture report arrives as a PDF, ready for a board.
What you get: the follow-up of every request, with its deadlines, without leaving the client area.
- 01
Managed takedowns
Takedown credits counted down, status at every step, expected deadline followed until the removal is obtained.
- 02
Investigations
One precise question, a shared journal where the analyst records steps and conclusions, a dated deliverable.
- 03
Monthly PDF report
Score, trends, open and closed findings, recommended actions: generated every month and on demand, archived in the client area.
Desktop application and mobile application
The same client area, on your desk and in your pocket.
The client area installs from the browser, with no app store, on Windows, macOS and Linux as on iPhone, iPad and Android. Same account, same rights, notifications at the threshold you set, code lock, automatic updates.
- 01
Installed from the browser
In its own window on desktop, on the phone’s home screen; updates are automatic.
- 02
Notifications
On the desktop and on the phone, at the severity threshold you set, with the same rules.
- 03
Session code lock
The application locks and asks for a code every time you come back; a device left open shows nothing.
Frequently asked questions
Do we need to install an agent or open access to our systems?
No. The platform works from the outside, on what circulates about your perimeter. You declare your assets, you verify your domains through DNS, and the client area installs from the browser.
How are the score and the priorities computed?
The exposure score, from 0 to 100, is recomputed at every synchronisation from the open findings, their severity, their freshness and the criticality of the assets touched; every factor stays readable. Priorities rank findings by severity, freshness, asset criticality and expected handling time.
Can you link a leak to an infected device or to a lookalike domain?
Yes, that is what exposure chains do. The graph links devices, credentials, sessions, lookalike domains, exposed hosts, executives, suppliers and breach sources, and every chain states a probable origin with its confidence: infected workstation, third-party breach, password reuse, phishing campaign, supplier compromise or exposed service.
Can you identify the accounts to reset, the devices to reinstall and the access to harden?
Yes, and nothing more: it is a security aid, never an HR tool. Every account of your domains receives an exposure score and a single recommended action, then joins a cohort: awareness recommended, device to reinstall, access to harden, to watch or no exposure. The list of exposed accounts and the recommended action exports for the security team, and the actions taken lower the score. Our data cannot prove MFA is on: “access to harden” flags a usable password on a sensitive target with no proof of a second factor.
What happens when a secret is revealed?
The value is never stored at VesperID. On request from an authorised member, with a reason, after re-authentication, it is read live, shown for the time of the check, and the event is written to the audit journal with its author and date. Each person has twenty reveals per day.
Does an organisation holding several licences see them in one place?
Yes. An organisation’s licences, one per subsidiary, per brand or per protected executive, read in the same client area, each with its composition of services, its quotas and its term; your team’s roles are set per organisation. An executive’s profile stays visible to them alone and to those they appoint.
Can we plug VesperID into our SIEM or ticketing tool?
Yes, in two ways: alert rules towards a webhook, Slack, Teams or e-mail, in real time or as a digest, and an API documented in OpenAPI exposing the same data as the client area, with CSV and JSON exports of the findings.
See the platform on your own perimeter.
An exposure assessment starts with a scoping call with an analyst; the first results land in the client area within a few days.
Bespoke offering: one price per service, no public price, no packages.