How it works
Outerwall maps each client from public sources before you add it, shows you what your client didn’t know about, confirms what’s real on assets your client has approved, and sends ranked tickets to your PSA. The first two steps use public sources only, so they need nothing from your client.
01 · Research
We map each company from public sources and keep it current, so most of a new client’s picture is ready the day you add them. Every fact comes with where and when we found it. Anything we can’t confirm is labeled likely, or thrown out.
1Where we look
2Already mapped · harborlending.example
3What happens next
What Harbor knew about: its domain, hosts and VPN, kept current.
What it didn’t know: a staging site, unlisted suppliers and a known-exploited flaw.
The FTC Safeguards Rule applies, so these become evidence Harbor will need.
What we can’t see is listed first, never hidden.
FirmSeen directly in a source we trust, with its date.
LikelyInferred, and labeled likely until a check or your client confirms it.
Thrown outToo old, or contradicted by a newer source.
Can’t seeKnown to exist, not measured. Listed, never hidden.
02 · Discover
Within the hour of adding a domain, before any scan, you see the hosts, suppliers and lookalike domains each client knew about next to the ones it didn’t, and any threats already in play.
| What | They knew | Outerwall found |
|---|---|---|
| Domains | 1 | 3 |
| Host names | 12 | 38 |
| Suppliers | 2 | 6 |
| Lookalike domains | 0 | 2 |
| Staff emails in breaches | 0 | 11 |
| Threats in play | 0 | 3 |
0 active checks sent to Harbor so far.
Flagged for you
03 · Validate
A likely finding stays labeled likely until a check proves it. On assets your client has approved, non-destructive checks confirm a finding or drop it. Then we trace the path an attacker could take from it, and what that path would reach.
Traced attack path · illustration
Non-destructive checks on approved assets turn a likely finding into a confirmed one, or drop it. A version number alone is never enough.
Findings are joined into the paths an attacker would take, including paths that start at a supplier, and ranked by what they would reach.
On the roadmap
Known attacker techniques, run safely inside the network through your RMM, to test whether your client’s defenses detect and stop them.
04 · Mobilize
Each finding is escalated as a ticket in ConnectWise, Autotask or HaloPSA, ranked by blast radius: how much damage it could do to your client. Before a ticket closes, we check the fix twice.
Each ticket carries the evidence and a plain-language note for your client.
A supplier’s breach, outage or insolvency. A new flaw on CISA’s known-exploited list that matches software a client runs. Staff credentials in a breach or infostealer log. A lookalike domain. A ransomware group naming a client.
New subdomains and addresses, DNS and email records. A change triggers a recheck of only the asset that changed.
Alert times are targets for the first partner release.
The category
Continuous threat exposure management (CTEM) runs five stages on a loop: scope, discover, prioritize, validate and mobilize. Research and Discover cover scoping and discovery for each client. Ranking by blast radius is the prioritize stage, and it applies at every step. Validate and Mobilize keep their names.
A 30-second read: what Outerwall finds on a fictional mortgage broker, step by step.