See your company the way an attacker researches it.
Before an attack comes the research: which subdomains and services are reachable, which addresses of your domain turn up in known data breaches, what your documents give away in their metadata, which keys sit in public code, and what a scammer needs for a convincing phishing mail. With your mandate, we collect what is public about your organisation and hand you a written report: every finding with its source, how serious it is and how to close it.
From Gallneukirchen near Linz: on site across Upper Austria, remote everywhere else.
- Subdomains and certificates from public certificate logs
- Services and software versions as public internet search engines list them
- Addresses of your domain in known data breaches, from breach notification services
- Metadata in published documents: names, software, internal paths
- Keys and passwords in public code repositories
- What your website and profiles give a scammer for a convincing phishing mail
From the mandate to a written report
Mandate and scope
We agree in writing which domains, brands and sites we look at. Only your own organisation.
Collect
Public sources only: certificate logs, DNS, search engines, code platforms, breach notification services, your own documents.
Assess
We rank every finding by how much an attacker could do with it.
Report and close
You get the report with sources and fixes. If you like, we close the gaps with you.
Common questions
Something missing? Ask us directly, a few sentences are enough.
Is this legal?
Yes. We only use public sources, only for your own organisation and only with your written mandate. We do not log in anywhere and we test nothing.
How is it different from a security check?
The security check looks at your systems. The OSINT analysis looks at everything that is public about your organisation, including documents, code and what your website tells a scammer.
The security checkDo you look at our employees?
Only at what is public in a business context, such as roles and address patterns that make phishing easier. Private lives are off limits.
What happens with the findings?
They are yours. If you like, we close them with you through hardening and train your team against the phishing they make possible.
Hardening
More in this area
I want Blax as my partner.
Tell us what you're building and we'll get back to you within one business day.
You talk to Fabian Wagner, founder
No sales desk in between: he reads every enquiry himself.
Prefer a call? +•• ••• ••• •• ••