CTM360

Discovers fake websites, social media profiles, and mobile applications impersonating the organization, using domain similarity, visual fingerprinting, and content analysis.

Monitors newly registered domains using typosquatting, homograph, and combosquatting techniques against the organization's brand, surfacing phishing infrastructure before campaigns launch.

Monitors dark web forums, marketplaces, and access broker listings for mentions of the organization, active threats, and sale of stolen access or data.

Monitors and alerts on deep and dark web, domain abuse, brand impersonation, social media and geopolitical risk.

Discovers or ingests external attack surface and digital asset data to curate organization-specific risk.

Supports machine-to-machine integration via JSON, APIs and STIX or TAXII, with sharing across private and public communities such as ISACs.

Continuously enumerates internet-exposed assets (domains, IPs, subdomains, certificates, cloud storage, APIs) using passive DNS, certificate transparency logs, and active probing, including assets outside the official inventory.

Identifies cloud resources, SaaS applications, and exposed services deployed by business units without IT or security team visibility or approval.

Identifies software stacks, versions, and components running on discovered assets through passive banner analysis and active probing, mapping CVE exposure without authenticated scanning.

Profiles each third party at intake, capturing criticality, data sensitivity, service type, geography and regulatory requirements, to determine which risk domains apply to it and to scope the depth and cadence of assessment accordingly.

Watches third parties between assessments for new risk events, such as security incidents, financial distress, sanctions or adverse-media hits and regulatory actions, and surfaces them through dashboards, reports, alerts, reminders and notifications; stronger implementations re-score the third party and trigger escalation or corrective action when an event crosses a defined threshold instead of only updating a dashboard.