Attack surface monitoring
Level 3 tracks changes to your agreed external attack surface. Recurring checks compare domains, certificates, services and configurations with the documented baseline. Agreed sources and methods define the coverage.
Level 3
Security Monitoring
Identify emerging risk. Track changes and remediation.
Assessment areas
ChangesCompare your external attack surface with its baseline.View details
Configuration driftIdentify new or recurring issues following changes.View details
Configuration drift and regressions
Recurring checks highlight relevant configuration changes and findings that reappear. This helps identify where later changes affect earlier remediation. Each comparison accounts for assessment time, coverage and changed conditions.
Dark web & leaksReview signals from agreed sources for origin and attribution.View details
Dark web & leak monitoring
We check agreed business domains and identities against defined, permitted sources. Signals are reviewed for origin, date, duplicates and attribution. Reporting distinguishes historical leaks, signs of current exposure, uncertain matches and coverage gaps; an old leak alone does not establish a current intrusion.
Emerging risksRelate new vulnerability information to your known systems.View details
Vulnerability intelligence
New vulnerability information is checked against your known systems. We assess whether the product, visible version and prerequisites match, distinguishing possible exposure from confirmed findings.
Your deliverables
A documented history of your attack surface, with relevant changes, current priorities and a traceable remediation status.
Scope & working together
Recurring assessments at the agreed interval. No permanently staffed SOC or incident response.
Prioritization over time
New evidence, changed reachability and your business context can change priorities. EPSS and KEV inform applicable findings. The history explains reassessments and clearly identifies missing data or failed checks. Missing data or failed checks are not treated as an all-clear.
Remediation, reporting and reassessment
Reports show relevant changes, open, remediated, recurring and unverified findings, with recommended next steps. We agree specific notification criteria and clear objectives for retests.
Cadence and service boundaries
Describe your needs in the enquiry form. We agree scope, sources, intervals, notifications and handling times in writing, for example weekly, monthly or quarterly. Level 3 provides recurring assessments; a permanently staffed SOC, exhaustive real-time detection and incident response are excluded.
Related reading
Which systems would you like assessed?
We agree systems, scope and timing in writing.