What is a predictive risk fabric?
A predictive risk fabric is a live map of public facts about companies: what each one exposes online, the suppliers it depends on and the software it runs. Outerwall builds it before you add a client. Because companies are linked through the suppliers and software they share, an event at one of them reaches every client it affects within hours.
Two families of modules run on the fabric. Exposure management, also called continuous threat exposure management (CTEM), finds and fixes what could reach your client. GRC (governance, risk and compliance) proves your client is in control.
Fixes become evidence, and the register sets priorities
The predictive risk fabric
Every company, its suppliers and its technology
Mapped from public sources before anyone signs, and kept current
Three views of each company, linked
The outside view and the suppliers are mapped for companies before they become your clients. The inside view is added only for your clients, read-only, with their approval. Because the fabric knows who shares what, one event reaches every client it touches.
Outside
Hosts, certificates, services, lookalike domains and leaked credentials, read from public sources before anything is scanned.
Inside
With approval, Microsoft 365, Entra and Defender: who holds admin rights, who signs in without MFA, which devices are missing a patch, which apps have been let in.
Suppliers
The providers behind every client, including the ones nobody listed. Because the fabric already holds them, it knows which clients share each one.
When something happens, every client it touches knows first
The map exists before you add a client, so most of its picture is ready within the hour.
Mapped before you add a client
The Research engine, the part of Outerwall that reads public sources, covers companies well beyond your clients: what each one exposes, what it has to disclose, what happens to it, and what its people and suppliers say about it. It touches no one.
Adding a client links it to what we already know
Add a client’s domain and its picture is already there: its hosts, the suppliers it depends on and the technology it runs. With your client’s approval, the inside view joins it, read-only.
An event at one company reaches every client it affects
A breach at a supplier, a newly exploited flaw or a lookalike domain reaches every organization it touches within hours, worked out for each client on its own, with each client’s data kept apart.
It lands where your team works
A ranked ticket in your PSA, a proposed risk in your client’s register, a statement taken down from its Trust Center. Tested rules decide, so every warning carries its reason.
How the fabric is built
The Research engine reads five kinds of public information, from around 40 families of sources, for each company it covers in the United States and Ireland. It reads only what any visitor could read, so it needs no permission and touches nothing.
| Source | What it is | Examples |
|---|---|---|
| Infrastructure | What a company exposes technically | Certificate logs, DNS records, internet scan data, cloud address ranges, mail settings |
| Records | What it has to disclose | Company registers, licenses, certifications and filings |
| Events | What happens to it | Breach notices, outages, insolvencies, acquisitions, new flaws on the known-exploited list |
| Workforce | What its people say in public | Job ads that name systems, staff addresses in breach data |
| Vendor references | What its suppliers say about it | Case studies, trust pages, subprocessor lists and contract awards |
Active only on approval
Scanning touches only what your client has approved, after it proves control, signs a scope and gets 24 hours’ notice. The inside view is read-only: settings and metadata, never mail, files or chats.
Decided by tested rules
Every finding, risk and control state comes from a tested rule, so the same evidence always gives the same answer and a person can read the reason. Models help read public pages and draft words, they never decide, and a person reviews every draft.
Walled, client by client
Public facts live in a shared map. Everything about one client, and everything it lets us read, sits in its own walled section, kept apart by the database itself.
Within hours of a change
A fast-moving change, such as a supplier breach or a newly exploited flaw, reaches every client it touches in under 6 hours. A daily change, such as a new subdomain, within 24.
Exposure management and GRC, on one fabric
Start with Discover and add modules as your client grows. Each one reads the same fabric, so nothing is set up twice. Choose a module to see what it does.
Exposure managementCTEMFind and fix what could reach your client
GRCGovernance, risk and complianceProve your client is in control
Exposure management
Discover
Discover maps your client from public sources before anything touches its systems. Add one domain and most of its picture is ready within the hour, because the fabric already holds it.
- The hosts, domains and services it exposes, including the ones nobody listed
- The suppliers behind it, found from the traces they leave
- Lookalike domains, staff credentials in breach data and threats already in play
- A proposed scope, for your client to confirm
- Watched for change: a new host or supplier is flagged within 24 hours
- Needs
- One domain. Nothing is scanned until your client approves
- Lands in
- Your partner portal and your client’s report
harborlending.examplepublic sources only
| They knew | Found | |
|---|---|---|
| Host names | 12 | 38 |
| Suppliers | 2 | 6 |
| Lookalike domains | 0 | 2 |
| Staff emails in breaches | 0 | 11 |
| Threats in play | 0 | 3 |
0 active checks sent. Everything here is from public sources.
Exposure management
Remediate
Remediate ranks every finding by blast radius, the damage it could do judged by what an attacker could reach from it, confirms what’s real and sends the fix to your service desk.
- Findings joined into attack paths, including paths from a supplier, and ranked by blast radius
- Safe automated checks that confirm a flaw on approved assets
- The inside view, read-only: Microsoft 365, Entra and Defender
- Ranked tickets with the evidence and a plain-language note for your client
- A ticket closes only when two checks confirm the fix
- Nothing on your client’s systems is changed: your technicians make the fix
- Needs
- Proof of control (a DNS record or a file), a signed scope and 24 hours’ notice
- Lands in
- ConnectWise, Autotask, HaloPSA, ServiceNow or Jira, as ranked tickets
Ticket #4821Rank 1 of 4
Exploited flaw on the VPN gateway
Harbor Lending · confirmed · could reach the payroll system
In your PSA, with the evidence and a note for your client.
Exposure management
Validate
Validate is penetration testing, ordered and tracked inside Outerwall, by your own testers or by a trusted network of third-party, AI-assisted, human-led testers.
- Your own testers or ours: findings land in the same place either way
- Our network works to one methodology aligned to CREST’s
- Scope set from the fabric, so it covers the parts your client forgot
- A certified tester leads every engagement and signs off each finding
- Findings land in Outerwall as they’re confirmed, then in your service desk
- Needs
- A scope agreed in writing
- Lands in
- Outerwall and your service desk, as each finding is confirmed
One methodologyCREST-aligned
- Scopeagreed in writing, nothing outside it touched
- Reconnaissancemapped by tools, every result checked by a tester
- Exploitationhow far an attacker could really get; criticals reported at once
- ReportingCVSS 4.0, grouped by root cause, with the fix
- Clean-upevery account, tool and file removed
- Retestfixes retested free
Testers hold certifications such as OSCP, OSEP and CREST CRT.
Exposure management
Suppliers
Suppliers finds the providers behind your client, including the ones nobody listed, ranks them by the damage a failure would do, and watches them.
- Found from DNS records, job ads and vendor case studies
- Ranked by the damage a failure there would do
- Watched for breaches, outages, bankruptcies and acquisitions
- The suppliers your clients share, seen across your whole book
- A breach flagged at every client that depends on it, within hours
- Needs
- Nothing to start. Your client confirms the list
- Lands in
- One view across your book, and a ticket per client
Payroll providerbreach notice
14 of your 40 clients use it
All 14 flagged in one view, with the evidence, so you raise it with every one the same morning.
GRC
Predictive GRC
Predictive GRC builds your client’s risk and compliance program from what the fabric already holds and runs it month after month. When something happens that could affect your client, it proposes the risk before it turns into an incident. Your vCISO reviews and approves the work.
- A supplier register and a risk register, drafted from evidence
- Controls for each rule that applies, tested: met, not met or can’t be evaluated
- Amendments to your client’s own policies where policy and practice disagree
- Evidence packs for the FTC Safeguards Rule, NYDFS Part 500, Regulation S-P and more
- Risks proposed from events in the fabric, each with its evidence
- The monthly digest, the quarterly review and the board report, ready to approve
- Needs
- Your client confirms its suppliers and approves changes
- Lands in
- Your client’s registers, evidence packs and board report
Northgate IT · your vCISO queue40 clients
- 9 risksProposed after the payroll provider’s breach noticeThe 9 clients that gave its app access to their accounts
- 3 policiesAmendments where the access policy and Entra disagreeDrafted from evidence, for the owner to approve
- 2 answersQuestionnaire answers drafted from approved claimsEach one kept with who it went to
- 1 reportHarbor Lending’s quarterly risk reviewReady for your vCISO and the owner
Every item waits for a named person to approve it.
GRC
Trust Center
Trust Center is built on Predictive GRC. It turns the claims your client has approved into a page on its own domain, under your brand.
- Each statement dated and tied to evidence
- Taken down the moment its evidence lapses
- Security questionnaires answered from the same approved claims
- Every answer sent kept with who it went to
- Needs
- Predictive GRC, and your client’s approval of every statement
- Lands in
- A page on your client’s own domain, under your brand
trust.harborlending.exampleunder your brand
- Customer data encrypted at restEvidenced Oct 3, 2026
- Suppliers reviewed and watchedEvidenced Oct 3, 2026
- Annual penetration testEvidenced Sep 12, 2026, through Validate
- MFA required for every accountHeld back until the evidence supports it
A statement whose evidence lapses comes down without waiting for anyone.
Two families, one picture of your client
| Exposure management | GRC | |
|---|---|---|
| The question it answers | What could reach your client, and is it fixed? | What does that mean for its obligations, its suppliers and what it has promised others? |
| Who uses it at your firm | Your technicians and your security operations team | Your vCISO or account lead |
| Who signs off at your client | Its IT or security lead approves the scope | A named owner, such as the CEO or chief risk officer, approves risks, policy changes and anything published or sent |
| What it reads | The fabric, approved scans and the inside view | All of that, plus your client’s own documents and what its suppliers reply |
| What it produces | Ranked findings, tickets in your service desk and confirmed fixes | Supplier and risk registers, proposed risks, tested policies, evidence packs and the Trust Center |
| How often | Within hours of a change | A proposed risk within hours of an event, a monthly digest, a quarterly review and an annual board report |
What exposure management finds and fixes becomes GRC’s evidence. What your client’s risk register says matters sets what exposure management looks at first.
How pricing works
Per organization, per month, sold through MSSP and MSP partners. You set your own price to your client and keep the margin.
- Start with Discover
- Add modules as your client grows. Each one reads the same fabric, so adding one costs your client nothing to set up.
- The full fabric
- All six modules, priced well below the modules added up.
- Banded by internet-facing footprint
- Never by the number of accounts or devices, so connecting the inside view never raises the bill.
- Trust Center comes with Predictive GRC
- It shows what Predictive GRC can prove, so the two are taken together.
- Validate, per engagement
- Penetration tests are priced per engagement, and fixes are retested free.
- ISO 27001 readiness
- An extra on Predictive GRC, with a drafted Statement of Applicability.
Founding partners hold founding pricing. For current prices, email partners@outerwall.ai.
Organizations of 20 to 5,000 users
Always through the MSSP or MSP that protects them.
Every organization in that range has an outer wall, suppliers it depends on and, more and more often, a risk and compliance program it has to show someone. Most lean on an MSSP or an MSP for all of it, so we build for them and sell only through them. An organization with a security team of its own gets Outerwall the same way, through a partner, with its own team in the loop. The United States is our core market, and we already work with clients in Ireland.
Firms under rules such as the FTC Safeguards Rule in the US, or NIS2 and DORA in Ireland, feel it sooner, because those rules already ask for the evidence the fabric produces.
Run the fabric on your own domain first.
You start with your own domain, then add the organizations you protect, one at a time.