Our sources
Where what we show you comes from
An alert is only worth its provenance. Here are the three channels that feed VesperID, what our collection partners do in them, and what our analysts add. An alert is only worth its provenance. Here are the three channels that feed VesperID, what our collection partners do in them, and what our platform and our analysts add before a signal reaches you.
- Network infiltration Collection partners
- Leak acquisition Collection partners
- Open web and dark web Continuous collection
- Alerts
- Client area
- Monthly report
What you get: one platform, one decision per signal, whichever channel saw it first.
In one sentence
Infiltrating criminal networks and acquiring leaks is entrusted to specialised collection partners, under contract, at the scale this work demands. VesperID, a French cybersecurity company, operates its own platform on top of those feeds: correlation, scores, prioritisation, playbooks and reporting, in a space isolated per client.
Network infiltration
Specialised analysts follow cybercriminal forums, marketplaces and messaging channels, closed spaces included, and the actors who sell access, data and kits there.
Specialised analysts maintain access to the forums, marketplaces and messaging channels where access, data and kits change hands, including closed spaces that only admit vetted members. They follow actors over time: an initial access broker putting a VPN up for sale, a seller announcing a database, a channel recruiting accomplices. Whatever concerns your perimeter comes out as a dated, sourced mention tied to the actor who posted it.
- Cybercriminal forums, public sections and members-only sections
- Marketplaces for access, data, cards and phishing kits
- Encrypted messaging channels and groups
- Blogs and claim sites of ransomware groups
- Profiles and track records of the actors who sell or buy
A seller posts on a closed forum: “VPN access, logistics company, France, 800 seats”. The message is captured shortly after it is posted; the platform matches it against the keywords and domains of your perimeter, and an analyst checks whether it points to you before the alert is sent.
Leak acquisition
Leaked databases and information-stealer logs are acquired and indexed as soon as they circulate, with the metadata that ties each exposure to an identity and a date.
Leaked databases and information-stealer logs are acquired and indexed as soon as they circulate, before the credentials they contain are sorted and resold in batches. Every record keeps the metadata that ties an exposure to an identity and a date: the source, the moment of the leak or of the infection, the device involved, the service targeted. VesperID never writes the value of a password, the hash supplied by the source or a cookie value to its database.
- Leaked databases, compilations and combolists
- Stealer logs: credentials, session cookies, saved forms, machine fingerprint
- Exposure metadata: source, date, hash type, service targeted
- Several years of history, searchable as soon as an asset is verified
An employee’s personal laptop is infected on a Tuesday evening. The machine’s log, which contains an open session on your SSO, starts circulating on the Wednesday. It is acquired, indexed and matched to your domain the same day: you revoke the session before it is replayed.
Open web and dark web
Ransomware leak sites, pastes, public repositories, exposed buckets, social networks, certificate logs, domain registrations and the exposed surface, crawled continuously.
Everything published without being closed off is collected and normalised continuously: ransomware groups’ leak sites, pastes, public code repositories, exposed storage spaces, social networks, certificate transparency logs, domain registrations, and your organisation’s exposed surface, hosts, ports and services. This is the channel that spots a lookalike domain on the day of its certificate, or an API token forgotten in a repository.
- Ransomware groups’ leak and claim sites
- Pastes, public code repositories, container images, exposed buckets
- Certificate transparency logs and domain registrations
- Social networks and public profiles
- Exposed surface: hosts, ports, services and versions visible from the internet
A domain that copies your brand with a doubled character obtains a certificate at 9:12. It shows up in the transparency logs, is matched to your monitored brands and scored as phishing-ready: the alert goes out before the first email.
What VesperID adds
The feeds are only raw material. The VesperID platform turns them into a decision: tied to your perimeter, explained, ranked, with the expected action; our analysts handle what a rule cannot settle.
Discover the platform-
Correlation across sources
The same person seen in a leak, in an infected device’s log and in a still-valid session is one incident, not three alerts.
-
Explained risk scores
Every exposure gets a score whose factors are readable: freshness, nature of the data, criticality of the asset, validity of the access.
-
Prioritisation
The inbox puts what matters first: a replayable privileged access ranks above an address in an old compilation.
-
Exposure chains
A graph links devices, credentials, sessions, lookalike domains, hosts, executives, suppliers and breach sources; every chain carries a probable origin, its confidence, its impacts and the playbook that cuts it. A service in its own right.
-
Exposed staff
Every account of your domains is aggregated, scored and placed in a cohort: awareness recommended, device to reinstall, access to harden, to watch, no exposure, with a recommended action and an export for the security team. A service in its own right.
-
Surface drift
Whatever appears, changes or disappears on your exposed surface is dated and compared from one synchronisation to the next.
-
Phishing-readiness index
A lookalike domain is scored by what it has already activated: certificate, mail server, copied login page.
-
Executives and suppliers
A person’s exposure, once they have accepted the invitation themselves, and that of your critical suppliers are tracked as assets in their own right.
-
Fourteen playbooks
Device isolation, credential reset, lookalike response, supplier questionnaire, exposure hardening, card exposure, bank account exposure, triage: every case points to the course of action, step by step.
-
Analysts on request
Alerts go out automatically according to your rules; an analyst qualifies a case at your request, handles investigations and takedowns, and reviews your perimeter with you at every review.
-
Trends and last visit
The score and the findings over 90 days, and every time you come back what appeared, what was resolved and how the score moved.
-
Reports and a platform run in-house
A board report every month, a platform run by a French cybersecurity company, isolated per client, with no password or cookie kept.
What we do not do
Four limits we set ourselves, because they protect our sources as much as your data.
- We do not name our collection partners, by contract and by caution: a named partner is an exposed partner.
- We keep neither the value of a password, nor the hash supplied by the source, nor a cookie value: metadata is enough to decide.
- We never test a credential against your services and we never replay a session; the only safe answer remains a reset.
- We invent no threat: every item shown has a source, a date and a place of publication, and the transfer to our collection provider, established in Canada, rests on an adequacy decision supplemented by standard contractual clauses, described in our privacy policy.
Frequently asked questions
Does VesperID infiltrate the forums itself?
No. Infiltration and leak acquisition are the trade of specialised collection partners, with whom VesperID is under contract. VesperID operates the platform that ties those feeds to your perimeter, correlates them, scores them and sends them to your channels according to your rules; its analysts handle investigations and takedowns.
Why do you not name your partners?
Because a named partner becomes a target, and because our contracts forbid it. During scoping we describe the nature of the sources, their coverage and their limits, and we answer any question from your data protection officer about transfers.
How fresh is the data?
It depends on the channel. Leaks, stealer logs and forum mentions are indexed as soon as they circulate; certificate logs and domain registrations are followed continuously; the exposed surface is re-examined in cycles. Every item carries its observation date, and an alert goes out automatically according to your rules.
What does the history cover?
As soon as an asset is verified, the history available on that asset is pulled in: several years of indexed leaks and logs. That is often where the first findings are, and it is what tells you that a password exposed two years ago was never changed.
Can we see what circulates about a third party, a competitor or a candidate?
No. From the client area, you only see what is tied to assets whose ownership you have proven or to people who have accepted a protection profile. An investigation concerns a threat aimed at your organisation, a compromised supplier or an access for sale, for instance. We handle no request about a candidate, an employee or a person’s private life.
Let us see what already circulates about you.
One hour with an analyst: what these three channels have already seen about your perimeter, and what is worth monitoring.
Bespoke offering: one price per service, no public price, no packages.