DeepExpose
How DeepExpose works
From request to report takes a few minutes of your time.
- Request accessDeepExpose is invite-only. Tell us about your company and we create your account. Sign-in uses a password plus a code from an authenticator app.
- Enter a domain and confirm permissionType the company domain and confirm you own it or have written permission to assess it. Optionally add a client label.
- We read public informationDNS records, a few public pages on the company website and public search results. Nothing is logged into, exploited or sent to the people being assessed.
- Read the reportYou get one score, a score for each area and a prioritised fix list.
- Fix, re-scan, compareAfter changes, scan again and compare the two reports. Turn on monitoring to be told when the score moves.
How the score is built
| Area | Weight | What raises it |
|---|---|---|
| Executive voice exposure | 35% | Leaders with public audio or video that could be cloned |
| Email spoofing | 30% | Missing or weak SPF and DMARC protection |
| Lookalike domains | 20% | Many convincing look-alike domains left unregistered |
| Process leakage | 15% | Public detail about payment and approval steps |
0–29Low
30–49Medium
50–69High
70–100Critical
The weights are our own judgement, built from how these attacks usually work. Treat the score as a way to prioritise, not as proof that an attack will or will not happen.