Public Discovery
We map what an attacker can learn about your organisation from public sources alone, from exposed staff details and leaked credentials to forgotten assets, so you can see your business the way an adversary does.
We show you what an attacker already knows about you
Before an attack begins, adversaries gather intelligence from public sources that never touches your network. We do the same reconnaissance, safely and passively, so you can see the exposed information that quietly shapes their next move.
Open-Source Intel
We gather details from websites, public records, job adverts and social media that reveal how you operate.
Staff Exposure
We identify employee names, roles and contact details that fuel targeted social engineering.
Leaked Credentials
We check public breach data for exposed staff logins that attackers reuse against you.
Domain & Brand
We uncover lookalike domains and brand misuse that attackers set up to deceive your customers.
Metadata & Documents
We examine published files for hidden metadata that leaks usernames, software and internal paths.
Forgotten Assets
We surface subdomains and services you may have lost track of but still expose to the internet.
Attackers Do Their Homework. So Should You.
Long before anyone tries your firewall, they read your website, scan your job listings, note who works where and search breach databases for a password one of your staff reused years ago. None of this touches your systems, so none of your defences ever fire. Yet it hands an attacker the map they need to choose their target and their pretext.
We carry out the same open-source research, entirely passively, and hand you the results in plain language. You learn which staff details are exposed, which credentials have leaked, which domains impersonate you and which forgotten assets are still reachable. With that picture you can reduce your public footprint, warn the right people and remove the easy wins before an attacker collects them.
Standards and Frameworks We Follow
- Our reconnaissance follows the OSINT methodology set out in the OWASP testing guidance and the reconnaissance tactics catalogued in the MITRE ATT&CK framework.
- We reference the intelligence-gathering phase of the Penetration Testing Execution Standard (PTES) to keep our work structured and repeatable.
- Findings are tied back to the exposure and asset-management controls in ISO 27001 and the NIST Cybersecurity Framework so you can act on them within your existing processes.
Aligned to the frameworks that matter
Our testing follows the methodologies that set the global standard for application security.