One-time remote assessment
Remote External Exposure Baseline
A company-specific outside-in assessment that turns scattered exposure signals into a prioritized action plan.
What is included
A paid intelligence deliverable—not a generic scan.
- Primary company and domain identity mapping
- Credential, breach, and information-stealer exposure signals where lawfully available
- Ransomware, extortion, exposed-file, and metadata references
- Public repository, certificate, domain, and externally observable infrastructure indicators
- Brand, impersonation, and look-alike identity indicators
- Relevant third-party or supply-chain leads
- Human review, false-positive reduction, and confidence notes
- Secure 8-15 page report with a prioritized action register
Standard launch scope
- Organization1 legal entity
- Domains1 primary + up to 2 related
- Brands / identitiesUp to 3 approved references
- Target turnaround7 business days
- DeliverySecure PDF and action register
- MeetingsNot required
Larger populations, multiple subsidiaries, urgent timelines, or complex historical exposure are quoted separately.
What it answers
Questions an owner, IT director, or security leader can act on.
What is publicly or criminally exposed?
Relevant identities, records, filenames, domains, services, and references tied to the company.
Which findings are likely real?
Identity matching, source confidence, timing, duplication, and limitations are explained.
What should be validated first?
Actions are prioritized by likely business impact and owner responsibility.
Should monitoring continue?
The baseline establishes whether a recurring watch would add value and what it should cover.
Boundaries
Passive and authorized by default.
The standard baseline does not include penetration testing, credential validation, logging into accounts, contacting employees, active exploitation, social engineering, or installing software. Any active testing requires a separate written authorization and scope.
Appropriate information to begin
- Company name
- Primary public domain
- Industry and approximate size
- Authorized business contact
- High-level concern or decision
Do not submit passwords, confidential evidence, internal diagrams, or personal executive identifiers through the public website.
Start remotely
Request the baseline without scheduling a sales meeting.
DarkWater will confirm authorization and scope, then send the agreement, invoice or checkout, and secure intake instructions.