DarkInvader helps organisations discover, monitor and manage risks across their internet-facing assets.
As an External Attack Surface Management (EASM) platform, DarkInvader combines asset discovery, vulnerability assessment, open-source intelligence (OSINT), dark web monitoring and AI-assisted analysis to help security teams understand their external exposure.
We believe effective cybersecurity requires more than identifying threats. It also requires responsible scanning, appropriate protection of sensitive information and transparency about how security intelligence is collected, analysed and presented.
Here is how we put those principles into practice.
Responsible and Authorised Security Scanning
Ownership verification before monitoring
DarkInvader uses domain ownership verification to establish authorisation before monitored scanning begins.
Customers verify control over their domains through an email verification process or DNS TXT record. Domains that have not been verified remain outside monitored scanning until verification is complete.
This helps ensure that security assessments are carried out within an authorised scope.
Customer-controlled scanning boundaries
Organisations can define the infrastructure included in their external security monitoring, including approved domains and IP ranges.
Customers can also exclude specific subdomains, wildcard patterns and IP ranges from assessment. These exclusions provide additional control over which assets are monitored.
Proportionate vulnerability assessment
DarkInvader combines external reconnaissance and baseline security checks with selected active vulnerability assessments, including checks for insecure default authentication on exposed services.
Scanning is scheduled and rate-controlled, with workload limits designed to manage assessment activity across customer environments.
Our approach is to provide useful security visibility while taking account of the operational impact of external scanning.
Protecting Customer Data and Security Intelligence
Organisation-level data separation
DarkInvader uses a multi-tenant architecture with organisation-scoped data access controls.
Customer records are separated through company-level access policies and permission checks. Where multi-organisation access is required, permissions are explicitly granted.
This helps ensure users access information relevant to their authorised organisation and role.
Authentication and access controls
DarkInvader incorporates security controls designed to protect access to the platform, including:
- Multi-factor authentication, including authenticator-app verification.
- Single sign-on integrations with supported identity providers.
- Role-based permissions and access controls.
- Encrypted API tokens and secure authentication mechanisms.
- HTTPS enforcement, session controls and login rate limiting.
These controls support organisations in managing access to their external security information.
Sensitive information handling
External threat intelligence can include sensitive information, particularly when investigating leaked credentials, breach records and compromised accounts.
DarkInvader masks sensitive values by default within supported intelligence workflows. Access to reveal protected information is permission-controlled and audit-logged.
This provides security teams with relevant evidence while applying additional safeguards to sensitive risks.
Responsible Use of External Threat Intelligence
DarkInvader combines information from multiple external intelligence sources to help identify potential risks affecting an organisation.
These sources include publicly available technical information, vulnerability intelligence, breach-related data, malicious infrastructure indicators and dark web intelligence.
Rather than presenting raw intelligence feeds in isolation, DarkInvader correlates relevant findings with monitored customer assets and provides context to support investigation.
Customer-matched intelligence records are retained where relevant to the service, with additional controls applied to sensitive information.
The objective is to help organisations understand which external signals are relevant to their security, rather than adding unnecessary noise.
AI-Assisted Security Analysis with Oversight
AI helps DarkInvader process external security information and explain complex risks in a more accessible way.
Our approach combines automated analysis with controls for information handling, validation and user oversight.
Controlled AI data handling
Information submitted for AI processing is scoped to the relevant organisation and task.
Where external AI models are used, requests are sanitised and unnecessary sensitive information is minimised or redacted. Relevant risk context may be included where required to support analysis.
Validation and accountability
DarkInvader uses validation mechanisms to check AI-generated risk analysis before it is stored. Additional verification is applied to supported AI knowledge workflows, and AI processing activity is recorded at organisation level.
These controls help improve the reliability and traceability of AI-assisted analysis.
Nyx, our AI security consultant
Nyx helps users investigate risks, understand potential implications and explore appropriate next steps.
Nyx can recommend actions but does not independently execute changes to customer environments. Actions proposed through Nyx require user approval.
Other background AI processes support automated triage and analysis, with validation and audit mechanisms appropriate to their workflows.
AI is used to support security decisions, not to replace the expertise and judgement of the people responsible for them.
Recognised Cybersecurity Guidance
DarkInvader's capabilities support activities described in recognised cybersecurity guidance, particularly in relation to external asset visibility, risk identification and continuous security monitoring.
NCSC External Attack Surface Management Buyer's Guide
The UK National Cyber Security Centre (NCSC) provides independent guidance to help organisations assess EASM products and identify the capabilities they need.
Its EASM buyer's guide groups common product capabilities into three areas:
Visibility and insight
DarkInvader discovers and maps internet-facing assets, including domains, subdomains, services and associated infrastructure. Ongoing monitoring helps organisations identify changes across their external attack surface.
Security analysis
The platform identifies relevant vulnerabilities, misconfigurations, exposed services and intelligence findings that may require investigation or remediation.
Supporting functions
DarkInvader provides risk context, management reporting and platform capabilities that help teams interpret risks, monitor changes and prioritise security activity.
These capabilities address important considerations discussed in the NCSC's EASM buyer's guide.
Read the NCSC External Attack Surface Management buyer's guide
NIST Cybersecurity Framework 2.0
The NIST Cybersecurity Framework (CSF) 2.0 provides a structured approach to identifying, managing and communicating cybersecurity risk.
DarkInvader provides external security information relevant to two of its core functions:
Identify
Automated asset discovery and external exposure analysis help organisations improve their understanding of internet-facing systems, services, associated assets and security risks.
Detect
Ongoing monitoring and external threat intelligence help security teams identify changes, suspicious exposures and potential security issues that warrant further investigation.
DarkInvader can contribute to these activities as part of an organisation's wider cybersecurity programme. It does not replace the other controls, processes or organisational responsibilities needed to implement the complete framework.
References to NCSC guidance and NIST CSF 2.0 describe the relevance of DarkInvader's product capabilities. They do not indicate independent certification, formal compliance assessment or endorsement by either organisation.
Supporting Enterprise Security Requirements
External attack surface management is an important component of a wider cybersecurity strategy.
DarkInvader helps security and risk teams maintain external asset visibility, investigate security findings and communicate emerging risks to relevant stakeholders.
Our platform supports organisations with:
- Visibility of internet-facing assets and associated exposures.
- Continuous monitoring and security intelligence.
- Risk prioritisation and remediation planning.
- Supplier-related external exposure assessment.
- Security reporting and management oversight.
For organisations evaluating DarkInvader, our team can discuss platform security controls, scanning scope, data protection considerations, integration requirements and other relevant procurement questions.
Further information about personal data processing and information governance is available in our Privacy Policy.
Frequently Asked Questions
Does DarkInvader require domain ownership verification?
Yes. DarkInvader requires domain ownership verification before monitored scanning begins. Customers can verify their domains through supported email or DNS-based methods.
How does DarkInvader protect sensitive risk data?
DarkInvader applies organisation-level access controls and permission-based safeguards. Sensitive values associated with supported breach and credential intelligence workflows are masked by default, with controlled and audited access to reveal them.
Does DarkInvader use AI to make security decisions?
DarkInvader uses AI-assisted analysis to help interpret risks, provide risk context and support investigation. Nyx recommends actions for users to approve rather than independently making changes. Automated background analysis operates with validation and logging controls.
How does DarkInvader support NIST CSF 2.0?
DarkInvader provides external asset discovery, monitoring and risk intelligence capabilities relevant to the Identify and Detect functions of NIST CSF 2.0. Organisations can use these capabilities alongside their wider cybersecurity controls and processes.
Does DarkInvader replace penetration testing?
No. DarkInvader provides ongoing external asset monitoring and vulnerability assessment, helping organisations maintain visibility between individual security assessments. It complements penetration testing and other security assurance activities.