Before you add them
Already mapped
Outerwall has already mapped Harbor Lending from public sources: certificate logs, DNS, internet scan data, registers, breach feeds, job ads and vendor case studies.
Within the hour
What Harbor didn’t know
You add harborlending.example. Before anything is scanned, you see 38 host names where Harbor had listed 12, and 6 suppliers where it had listed 2. One host is an unlisted staging site, found in a certificate log. Three threats are already in play: a known-exploited flaw that matches its VPN, a breach notice from its payroll provider, and a lookalike domain that can receive mail.
Days 1 to 3
Confirmed, and traced
Harbor proves control of its domain, signs the scope and gets our scan addresses 24 hours ahead. A non-destructive check confirms the VPN flaw. Outerwall traces where an attacker could go from it: sign-in, the file shares, then the payroll system.
Day 3
Four tickets in your PSA
Ranked by blast radius: how much damage each could do. First is the exploited flaw on the VPN gateway, with the evidence and a plain-language note for Harbor.
Ongoing
One supplier breach, 14 clients
Harbor’s payroll provider files a breach notice. 14 of your 40 clients use it, and all 14 are flagged in one view within hours. You raise it with all of them the same morning.
Example client
What does Outerwall find on a typical client?
Harbor Lending is a fictional mortgage broker with 60 staff, and one of 40 clients you look after. Outerwall finds an unlisted staging site, four unlisted suppliers, two lookalike domains and three threats already in play, confirms the worst one, and sends four ranked tickets to your PSA. The company is invented; every step is how Outerwall works.
The difference
What a scanner given only Harbor’s domains would have found
| Finding | A scanner with Harbor’s list | Outerwall |
|---|---|---|
| The VPN flaw | Yes, if the VPN was on its list | Confirmed, and traced to the payroll system |
| The unlisted staging site | No | Found in a certificate log |
| Unlisted suppliers | No | 4, ranked by blast radius |
| Lookalike domains | No | 2, one able to receive mail |
| The payroll breach across your clients | No | 14 clients flagged within hours |
See it on your own clients.
Design partners start with their own estate, then add clients as each release lands.