Threat group profiles
Aliases, origin, motivation, techniques, campaigns, and the flaws and industries linked to each group. Download any profile as a PDF dossier.
Over 900 groups profiledEverything you have online that could hurt you. In one place.
EdgeProtect is a threat and vulnerability intelligence platform you use in your browser. It finds what you have open to the internet, watches for lookalike websites using your name and scores the flaws in your software from 0 to 100, so you fix the riskiest first. Free to start, no card.
Attack surface
What do we have open to the internet? And what changed?
Give us your domain and we map everything of yours anyone online can reach. Run it again later and we show you exactly what changed in between.
- Subdomains, hosts, IP addresses and network ranges, plus DNS records, open ports and the services running on them.
- Known flaws on those services and SSL certificates, grouped into findings for each host, with a network map.
- Compare any two scans to see what appeared or closed, and export either as a PDF.
- You start each scan, whenever you like. It maps what is exposed; it does not attack anything.
Scans come with a paid plan, and running one costs no credits. Unlocking its results uses credits. See plans and credit prices
Attack surface management · Scan comparison
Exposed passwords
Have any staff logins leaked? Find out safely.
Each scan checks for email addresses on your domain that appear in other companies' data breaches, so you know which people need a new password.
- Every affected address, with how many leaked records, how many people and which breaches they came from.
- How many leaked passwords are readable, so you can start with the accounts most at risk.
- We never display the passwords themselves. You see who is affected, not their secrets.
- Checked each time you run a scan, so run one again whenever you want a fresh look.
Revealing the credential records on a scan uses credits.
Exposed credentials · Part of an attack surface scan
Brand protection
Is anyone pretending to be us? We keep watching.
Scammers register web addresses that look like yours to fool your customers and staff. We keep looking for them and tell you as soon as a new one appears.
- Typos, swapped or lookalike characters and added words, watched continuously for each domain you add.
- Whether each one is registered and can receive email, and how it changes over time.
- Alerts for new lookalikes and for changes to the ones we already know about.
- A warning before your own SSL certificates expire, so you can renew in time.
Uses credits for each domain you watch. The first day of your first domain is free.
Brand protection · Lookalike domains · Certificates
Risk ranking
Which flaws should we fix first? The ones being used.
Every one of over 400,000 published flaws gets a risk score from 0 to 100, kept up to date as the evidence changes. Yours are the ones in software you told us you use, ranked riskiest first.
- Evidence of attacks counts most, then how severe the flaw is, then how widely exposed it is and related threat activity.
- Clear bands: 85 and over is Critical, 70 to 84 High, 40 to 69 Medium, 20 to 39 Low and 0 to 19 Info. Anything confirmed exploited is always marked "Emergency patch".
- Under 1% of flaws score Critical, and only observed or confirmed exploitation can put one there.
- Only flaws that affect you. Pick your software from a list or let us read it from your website.
Free. Tracking your software and seeing your ranked list costs no credits.
Vulnerability prioritisation · Risk score 0 to 100
0of 100
CVE-2024-3400VPN gateway lets an attacker run commands without logging in
Evidence it is being exploited Biggest factorStrong
On a government list of exploited flawsHow severe it is Strong factorStrong
No login needed, top severity ratingHow widely exposed it is Key contextWeak
One product line affectedReal threat activity Key contextBuilding
Linked to named threat groupsConfirmed exploited, so its action is always "Emergency patch", whatever the score.
AI action plans
What exactly should we do? A plan, in order.
Turn your top risk-ranked flaws into a prioritised fix plan, ready to hand to whoever does the work.
- Built from up to 100 of your riskiest flaws, in the order they should be fixed.
- Written only from verified data in your account. The AI is never given anything typed into a box.
- Each plan is a dated snapshot you can export as a PDF. Your latest 25 plans stay available.
- Your account data is stored in London.
Each plan uses credits. Action plans come with every paid plan.
AI remediation plan · PDF export
Software supply chain
Is there bad code in what we build? Check every package.
Your developers build on open-source packages written by others. Upload or paste a dependency file and we check every package against known supply-chain incidents.
- Files you can upload or paste: package.json, package-lock.json, pnpm-lock.yaml, yarn.lock and requirements.txt.
- Over 200 known incidents covering more than 5,000 hijacked or malicious packages.
- Saved files stay under watch, and you hear about it as soon as we spot a new incident affecting a package you use.
Free. Lockfile checks never cost credits.
Supply chain · Lockfile monitoring · Ten ecosystems
Threat intelligence
Who is targeting businesses like yours? And how do they work?
A research library on the criminal and state-backed groups behind attacks: who they are, which industries they go after, how they get in and which flaws they use. Every claim in a profile carries the quote and link it came from.
Much of it is public. Browse threat groups or search vulnerabilities without an account.
Ransomware tracker and your industry
Ransomware gangs and the victims they claim on their leak sites, by sector and country. Your dashboard shows which groups are hitting your sector.
Ransomware · Leak sites · Sectors400+Ransomware groups tracked
30,000+Victim claims recorded
Example · Who is hitting retail
Map a threat report
Paste a link to an attack write-up and get back the attacker techniques it describes.
Paste a link · Get techniquesLook up anything suspicious
Search known-bad IP addresses, domains, links and file fingerprints, plus a malware sample library.
Over 350,000 indicators · Over a million malware samplesTechniques and live attacks
A catalogue of over 700 attacker techniques, tests for over 300 of them, and a steady stream of attack attempts recorded by internet sensors.
Techniques · Tests · Sensor dataAlerts and reports
How will we hear about problems? As soon as we know.
We monitor continuously and tell you about anything new that affects you as soon as we spot it: by email, in the app, or straight into your own systems by webhook.
- We keep watching for newly published flaws, newly exploited ones and flaws whose likelihood of attack is rising, in the software you track.
- Keyword rules, such as a product and a version, catch flaws by name.
- One shared list of recipients for your organisation's alert emails.
- Webhooks send JSON to a web address you choose, with an optional secret header stored encrypted, and a test button.
Free. Alerts, webhooks and PDF exports cost no credits.
Alerts · Webhooks · PDF reports
PDF reports, made when you need them
Organisation reportRisk registerAction planScan resultsScan comparisonThreat group dossierSingle flaw report
Integrations
Can I use it from my own tools? Yes, and from your AI assistant.
For technical teams: a REST API for scripts and security tools, and an MCP server so assistants like Claude and Cursor can answer questions about your estate with real data. One key works for both.
Scoped keysPublic intelligence by default. Access to your own organisation's data is opt-in.
Locked downLimit a key to set IP addresses and give it an expiry date. We keep only a hash of the secret.
60 requests a minuteThe same on every paid plan. Each successful call uses credits.
71 MCP tools43 for public intelligence and 28 for your own vulnerabilities, scans, alerts and domains.
Read the developer docs How it works
How does it work day to day? You tell us once. We keep watching.
There is nothing to install on your computers or network. We work from public internet data, the software you tell us you use and any files you choose to upload.
- 1Day one
Tell us what to watch
Add your domains and the software you run. Pick it from a list, or let us read it from your website in about 5 to 30 seconds and check the list before it is saved.
- 2Whenever you like
Scan what you have online
Start an attack surface scan of your domain when you choose. Running it is free; you unlock the results with credits.
- 3All the time
We watch and score
We keep every known flaw scored and keep watching for lookalike domains, and we tell you as soon as we spot something that affects you.
- 4When it matters
You fix what matters
Work down one ranked list, turn it into a written action plan, and share PDF reports with whoever needs them.
Two-step sign-in, alwaysEvery account must use an authenticator app. It cannot be switched off.
Data stored in LondonYour organisation's data is stored in the UK.
Secrets encryptedStored integration keys and webhook secrets are encrypted.
Kept separateEach organisation's data is walled off from every other in the database.
No. EdgeProtect runs in your web browser. We work from public internet data, the software you tell us you use and any files you choose to upload, so nothing goes on your computers or network.
Attack surface scans run when you start them, so run one whenever you like. Lookalike domains and the risk score of every known flaw are monitored continuously without you doing anything.
We monitor continuously, and as soon as we spot something new that affects you, we tell you by email, in the app and by webhook. Matches are gathered into one clear message rather than a stream of noise, and you hear nothing at all when there is nothing to report.
Yes. Attack-surface scans, brand protection, AI action plans and the API and MCP server need a paid plan. The free plan gives you the full intelligence library, tracking for your own software and alerts about it. Every paid plan includes every feature, with credits that pay for the work.
A REST API for scripts and security tools, an MCP server for AI assistants such as Claude and Cursor, and webhooks that send JSON to a web address you choose. Brand protection alerts can also be formatted for Slack, Microsoft Teams, Splunk or Microsoft Sentinel. You can sync findings from Tenable Vulnerability Management and upload scan files from Nessus, Qualys, Rapid7, OpenVAS, Nmap, Nikto and OWASP ZAP. There are no ticketing or paging integrations.
The app never displays leaked passwords. It shows which staff email addresses appear in other companies' data breaches, how many records leaked and whether a password was readable, so those people can change it.
Get started
See it on your own business. Start free today.
Create a free account, add your domain and the software you use, and we start watching for you. Nothing to install and no card needed.