One-time
External Exposure Baseline
Company-specific assessment
A company-specific outside-in assessment with risk-ranked findings, evidence notes, and a practical action register.
Explore the baseline scope →Business cyber intelligence nationwide
See the exposure outside your managed environment.
DarkWater turns public and lawfully accessible external signals into prioritized, human-reviewed findings—without installing agents, requesting passwords, or adding another dashboard.
What external exposure intelligence means
Evidence from outside the organization, translated into a decision.
DarkWater reviews approved company domains, brands, identities, ransomware and leaked-file references, credential-exposure signals, public infrastructure context, impersonation, and third-party connections. Every material finding includes source context, confidence, limitations, business relevance, and a next step.
Ongoing
Continuous Exposure Watch
Analyst-reviewed monitoring
Analyst review for meaningful changes, priority notifications, and a concise monthly intelligence brief.
Explore the monitoring scope →One-time
Third-Party Exposure Review
Vendor or partner review
A focused external review of a vendor, partner, service provider, or acquisition target before or during a risk decision.
Explore the third-party review →Authorized add-on
Executive Exposure
Custom by population
Outside-in exposure review for approved high-visibility people with written authorization from the individual or organization.
Review scope and authorization →Custom
Threat Intelligence Advisory
By written scope
Focused research, incident-exposure triage, hunt development, report review, and leadership-ready analysis.
Review advisory options →Partners
MSP & Advisor Support
Direct or partner-delivered
Add an outside-in intelligence layer for clients without building a threat-intelligence practice from scratch.
Explore the partner model →Founder-led analyst review
Senior judgment stays attached to the work.
Every DarkWater cyber engagement is personally led by Douglas Peters, a U.S. Air Force Iraq War combat veteran, licensed North Carolina private investigator, and principal-level cyber threat hunter. His hands-on technical exploration began nearly 30 years ago; he has worked professionally in cybersecurity since 2013 and at the principal level since 2017.
Prior private-sector professional experience includes participation in the U.S. Secret Service-led Maryland Electronic Crimes Task Force. That background is applied to a practical buyer outcome: source-documented findings, stated confidence and limitations, and reporting built for the next decision.
Government and employer references describe professional background only and do not imply agency employment, authority, sponsorship, approval, or endorsement.
Review Douglas’s complete background →What you receive
- Direct access to the senior practitioner performing the review
- A written objective, approved scope, and defined deliverables
- Human validation before a signal becomes a finding
- Clear evidence, assessment, limitations, and unknowns
- Secure delivery to approved recipients
What is reviewed
Company-specific signals—not a generic threat feed.
Credential & identity exposureApproved company domains, business identities, brands, and relevant information-stealer or credential references.
Ransomware & leaked-file referencesCriminal claims, published indexes, filenames, folder paths, and metadata treated as unverified intelligence leads.
Public infrastructure contextExternally observable services, certificates, domains, repositories, and indicators that warrant owner validation.
Third-party connectionsVendor, partner, and fourth-party signals that may create questions for access, data handling, or incident response.
See the deliverable
A report built for action—not analyst-only detail.
The fictional eight-page sample shows how DarkWater communicates scope, sources, ranked findings, confidence, limitations, business impact, priority notifications, and remediation ownership.
- Executive summary for decision-makers
- Exact observed evidence and source context
- Clear distinction between an intelligence signal and proof
- Prioritized action register with suggested owners
How it works
A defined, remote engagement with minimal meeting load.
01
Request a scope
Share a company name, public domain, authorized business contact, and high-level objective.
02
Confirm authority
DarkWater confirms target, lawful purpose, identifiers, sources, timing, and recipient list in writing.
03
Analyst review
Relevant signals are matched, de-duplicated, prioritized, and documented by an experienced threat hunter.
04
Secure delivery
Receive the report, practical next steps, and an option for continuing monitoring when appropriate.
Clear cyber boundaries
Criminal-group claims, leaked-data references, filenames, and credential-exposure signals are intelligence leads—not proof of authenticity, present accessibility, breach scope, or compromise of the referenced organization’s systems. Standard services do not include purchasing stolen data, communicating with threat actors, bypassing access controls, downloading underlying stolen files, testing credentials, logging into accounts, exploitation, social engineering, or installing software.
Start with one defined outcome
Request a baseline, monitoring scope, or third-party review.
Email-only coordination is available. No sensitive data is needed through the public form.