CASP shows what attackers can already combine publicly — and where you break the chain. Manual, passive, signed report in ≤14 days.
Do not scan first and sort later. CASP manually clarifies which public signals form a chain and which link is cheapest to break. Then you know whether an authorized penetration test, an IT security audit, or ongoing re-investigation is next.
Hybrid, passive OSINT investigation of your public attack surface by a named analyst with targeted automation. You see which public signals form attack chains — and get prioritized countermeasures in a signed management and technical report. Entry CASP Lite from EUR 7,500 or CASP Full EUR 19,900 (5 domains included).
Authorized active testing when a system, web app, or cloud scope needs targeted verification. Penetration tests start only after written approval, clear rules of engagement, and reproducible evidence.
Structured assessment for security organization, controls, and evidence. Audits translate technical findings into verifiable actions for management, IT, customer questionnaires, and external review paths.
Executive Exposure for executives, founders, and key people: manual, passive OSINT on personal attack surface — from EUR 5,900 per person. Scope is named people, not domain packages. Optionally bundle with domain CASP.
Drei Phasen, eine Untersuchung. Jeder Befund wird manuell ermittelt, quellenbasiert validiert, in Angriffsketten eingeordnet und mit Gegenmaßnahmen versehen — strikt passiv, ohne Scan und ohne Zugriff auf Ihre Infrastruktur.
Manual identification of publicly available information across the approved scope: domains, subdomains, technology footprints, employee exposure, document leaks, credential breaches, and publicly visible organizational traces.
Konsolidierung und Korrelation verwertbarer Datenpunkte. Falsch-positive Befunde werden entfernt, Quellen nachvollziehbar dokumentiert, Risiken als realistische Angriffsketten formuliert — nicht als lose Liste.
For each attack path: a concrete prevention guide with priority, ownership, and effort — readable for management and engineering.
Attackers often need only one entry. Defenders must secure everything. CASP models the chain and shows which link is fastest and cheapest to break — that is where prioritized measures start.
See what attackers see.
Validated visibility into your exposed attack surface based on publicly available information.
Remove usable signals.
Prioritize exposed data and weak posture so teams can reduce the attack foundation deliberately.
Control recurrence.
Recurring cycles show whether risks return, disappear, or shift.
Sieben Kategorien, per Hand. No customer infrastructure is touched, scanned, or proxied. Only domains owned by the customer or with written authorization — verified by DNS TXT before start.
Owned domains, subdomains, IP ranges, ASNs, CIDR blocks, exposed services, and SSL/TLS posture.
Stack and version fingerprinting, end-of-life software, and exposed admin interfaces.
Registration data, DNS records, mail authentication, and clearly authorized domain relationships.
Leaked credentials in known breaches, exposed email patterns, and account takeover risk.
Public exposure of internal documents, source code, configuration, API keys, and secrets.
Executives and key personnel, social-engineering vectors, and insider indicators.
Industry-specific threat actors, recent incidents in adjacent organizations, and active campaigns.
Every engagement follows the same logic: clarify scope and authorization, investigate hybrid and passively, prioritize findings, hand over measures and score. Re-investigation cycles update score, findings, and trends as needed.
Scope for owned or authorized domains, brands, and relevant executives. Threat-model intake. Mutual NDA. DNS TXT verification of domain authorization before start.
Manual OSINT across all categories. Source corroboration, false-positive elimination, customer-specific attack chains, industry and role context.
Intelligence report (exec + tech), briefing call, Breach Probability Score with baseline, prioritized prevention roadmap.
After Lite or Full: one run per chosen interval (30 / 90 / 180 days or ad-hoc). Net-new, re-verification, score and trend — EUR 4,500 per run.
Scale · SECURED to CRITICAL
A board-grade single metric for public breach exposure — signed by the analyst and updated each cycle. Management and security share the same status over time.
Scanners produce volume. Pentests actively test an approved scope. Audits review governance. CASP sits before that: it places public information into realistic attack chains and shows which next test or evidence path is worth it.
Broad hit lists, often noise — without business priority or a resilient chain.
CASP → CASP validates manually and translates findings into risk and action logic. Nothing raw from the tool.
Valuable with a clear scope — but active and costly when the test space is unclear.
CASP → CASP sharpens the test space first and avoids unnecessary active tests.
They review processes and evidence — not what attackers can combine publicly.
CASP → CASP adds outside-in evidence and prioritized technical findings.
Industries: Finanz · Healthcare · Tech · Industrie · Öffentliche Hand · Bildung · Telekom. Buyers: CISOs, CTOs, SOC-Leads, Compliance, PE-/Holding-Operating-Partner.
CASP does not replace legal advice, a certification audit, or a pentest. It delivers repeatable, signed evidence: which external attack surface is visible, which risks follow, and which measures were pursued.
CASP supports NIS2 preparation by documenting external exposure, usable attack paths, priorities, and countermeasures. This does not replace legal advice, but it creates resilient evidence for risk and action communication.
For DORA-relevant organizations, CASP documents the publicly visible digital attack surface, usable attack chains, and prioritized remediation — as outside-in evidence for ICT risk management and supervisory communication. Not a legal opinion and not an audit substitute.
An ISMS needs traceable risks and documented treatment. CASP complements that work with an outside-in view of external assets, DNS/domain posture, credential exposure, and remediation history.
For SOC 2 and customer questionnaires, CASP provides traceable evidence that external attack surface is reviewed, assessed, and improved regularly. It is not a replacement for attestation, but an operational evidence component.
Entry CASP Lite from € 7.500 oder CASP Full € 19.900 (5 Domains inkl., +€ 1.490 je weitere). Re-Investigation € 4.500 pro Durchlauf — Abstand 30 / 90 / 180 Tage oder ad-hoc. Report in ≤14–21 Tagen nach Onboarding und Freigabe. Wir starten mit Domains, NDA und DNS-TXT — nicht mit einem Blind-Scan.