DeepReview · the outside view · before you signSee the target from outside, before you sign.
DeepReview builds a picture of a company from public information: the domains and brands it owns, where its systems run, what is exposed to the internet, what has leaked, and what it all adds up to. The deal team gets an A to F grade, a breach-risk profile and the evidence behind every finding.
Available on request · public information by default · for organisations with a legitimate interest in the target
The footprint the data room leaves out
A target's own list of its systems is usually its main domain and the ones somebody remembered. DeepReview starts from that domain and follows what public sources say the company actually owns.
Everything it owns online
Domains, subdomains, sibling and acquired brands, and marketing sites. Only a source whose claim is ownership adds to the footprint: a link or a passing mention is a lead to check, not an asset.
Where it runs
The hosting providers, networks and countries behind each system. This is where the mix of clouds, the forgotten legacy server and the third-party services show up.
What is exposed
Internet-facing services and admin panels, certificate and TLS weaknesses, and known vulnerabilities in the software versions those systems reveal.
What has leaked
The company's accounts and data in public breach indexes, so you know which credentials may already be in other hands before you connect networks.
Compliance and privacy signals
Certifications the company claims and can show, its privacy notices and practices, and how its websites handle the basics.
Reputation and stability
Public filings, news and archived pages: the context a security score alone leaves out. The target's key suppliers can be assessed the same way.
One letter, eight parts you can see
Findings roll up into an A to F grade built from eight sub-scores: attack surface, vulnerabilities, credential exposure, web and TLS, reputation, compliance and certifications, data privacy, and business stability.
The weights are fixed and the arithmetic is deterministic, so the same evidence always gives the same grade, and you can see exactly which part pulled the letter down.
- Attack surface58
- Vulnerabilities41
- Credential exposure32
- Web and TLS74
- Reputation90
- Compliance and certifications66
- Data privacy78
- Business stability84
From a list of findings to a view on the deal
A breach-risk profile
Weaknesses are chained into plausible attack paths: how an exposed panel, a leaked password and an old certificate could add up to a compromise, which data would be at risk, and a plain verdict on doing business.
An executive report
A report the deal team can read without a security background, with the technical detail and every source behind it for the people who need to check.
What changed by closing day
Run it again before close and see what is new, fixed or gone, not a fresh report to re-read. Findings you accepted or marked as false positives keep that decision.
Where DeepReview fits in due diligence and integration
DeepReview is at its most useful before you have any access to the target, and again as closing approaches. See every stage of a deal.
Due diligence
- Screen the target from its main domain before anyone has signed a non-disclosure agreement
- Compare the footprint it finds with the systems the data room says the target runs
- Assess the target's key suppliers the same way
- With the target's written permission, confirm exposures with the active check
Integration
- Run it again before closing to see what changed, and whether promised fixes show from outside
- Watch the acquired footprint until it moves under your own
- Re-assess after a rebrand, including the domains you retire
Every finding has to show its evidence
An assessment that invents things is worse than none. DeepReview is built so it cannot quietly do that.
- Each finding cites the public evidence behind it; a finding with no evidence is dropped.
- Any address, domain or account a finding names must appear in the evidence, or it is removed.
- A separate check re-reads each finding's evidence; what it cannot confirm is marked as unconfirmed and does not move the grade.
- A source that was blocked or unreachable is reported as such, never as "nothing found".
- Mentioning is not owning: a link to a domain does not make it the target's.
- Every analysis step is logged, so you can see how a conclusion was reached.
It looks at what is already public
DeepReview reads certificate transparency logs, DNS, vulnerability catalogues, breach indexes, company filings, archived pages and the target's own public websites. The most it sends the target is an ordinary request for a public web page, the same one any browser makes.
The optional active check
For an assessment where the target has agreed to it, DeepReview can confirm exposures by checking the live web hosts it has already proven belong to the target, and nothing else. It is off unless it is switched on for that assessment.
Use it only with the target's written permission.
Ask about an assessment
DeepReview is not sold off the shelf. Tell us about the target and your timeline, and we will agree how to work: an assessment run for you with the report delivered, or access so your team can run its own.
Assessments are only run for organisations with a legitimate interest in the target, such as a buyer in a deal or a customer reviewing a supplier.
Email us
Include the company and its main domain, your role in the deal and when you need the result. Please do not send confidential deal documents by email.