criticalDPH-2611-0482
412 employee credentials offered for sale
Found in a stealer-log bundle on a closed market. 38 passwords still work against your directory.
Security, infrastructure and continuity
Know what the dark knows.
Dephence watches the places your organisation cannot see, protects the systems it depends on and keeps them running through whatever happens next. One partner, one contract, engineers on watch at every hour.
Example finding
24/7Engineers on watch, every hour of the year
6Management seats in independent jurisdictions
19Services under one contract
1Team accountable from first finding to final report
What we do
Five practices, one line of defence
From the first sign of exposure to the last step of recovery, every service is run by the same team and reported in the same way.
01 · Watch
Threat exposure
We read the places where stolen data and fake identities are traded, so you hear about an exposure before it is used against you.
- Dark web monitoringYour domains, emails, IP addresses and credentials, found in criminal markets and leak sites.
- Credential exposureLeaked employee and customer passwords, checked so you know which ones still work.
- Impersonation watchLookalike domains and cloned websites, found early and taken down.
- Reputation watchFake accounts and harmful mentions across social networks, review sites and news.
- Threat intelligenceYour internet-facing attack surface, mapped and checked against live threat feeds.
02 · Test
Security testing
We test your websites, APIs and networks the way an attacker would, and report only the weaknesses we can prove.
- Vulnerability monitoringScheduled scanning of your hosts and websites for known flaws and weak configuration.
- Penetration testingAutomated and expert-led testing of websites, APIs and IP addresses, with verified results.
- Guided remediationOrdered fix plans for every finding, and answers from analysts when you need them.
03 · Protect
Network and application security
We filter what reaches your applications and give your people a clean, fixed route into corporate systems.
- Web application and API protectionA modern web application firewall for websites and APIs, with bot and account takeover defence.
- DDoS protectionAutomatic detection and mitigation of network and application floods, in seconds.
- Multi-layer firewallNetwork, transport and application filtering under one policy, managed for you.
- Corporate VPNStatic, clean IP addresses for secure access to corporate infrastructure.
04 · Host
Protected infrastructure
DNS, content delivery and servers with attack filtering built in, so availability does not depend on the next attack being small.
- Protected DNSAuthoritative DNS on a global anycast network, shielded from DDoS attacks.
- Content delivery networkFast global delivery for websites and media, with attack filtering at every edge.
- Virtual private serversCloud servers with DDoS protection and clean IP addresses included as standard.
- Dedicated serversSingle-tenant hardware with DDoS-protected network and full control.
05 · Sustain
Continuity and operations
Recovery plans that survive regional crises, and engineers who watch your systems and step in at any hour.
- Disaster recoveryRecovery plans built to survive regional conflict, sanctions, grid failure and natural disaster.
- Stability monitoring and 24/7 responseRound-the-clock monitoring of your systems, with engineers who step in and report in detail.
- Integrations and APIFindings and alerts delivered to your SIEM, ticketing and chat tools, with a full REST API.
How we work
Watch, protect, respond, report
The same four steps run through every engagement, whether we are watching a criminal market or restoring a data centre.
Watch
We read criminal markets, leak sites and your own attack surface for anything that exposes you.
Protect
We filter attacks at the edge, harden the perimeter and give your people a clean route in.
Respond
Engineers investigate and intervene at any hour, under procedures you have approved.
Report
Every finding and incident is documented with its source, its timeline and the next step.
Evidence, not alarm
Every finding arrives with its proof
You will never receive a vague warning from us. Each finding carries a source, a date, a reference and a severity, and ends with the one action that closes it.
- Counted severity. Five levels, shown as bars and a word, so nothing depends on colour alone.
- Verified by people. Analysts confirm matches before they reach you.
- Private by default. Personal data is redacted in every shared view.
Monthly exposure report · Example2026-11
critical
Live credentials for sale38 accounts · closed market
high
Lookalike domain with mail servertakedown filed · DPH-2611-0471
medium
TLS 1.0 enabled on a legacy host1 host · fix scheduled
clear
Executive profile removedplatform report closed
Exposure score42/100, down 17
Built to outlast a crisis
Governed from six independent jurisdictions
Dephence is managed from six seats in six geopolitically independent jurisdictions. Leadership, operations and data are distributed so that no single government, conflict, sanction or natural disaster can stop the service, or the recovery plans we run for you.
Management seat01
Management seat02
Management seat03
Management seat04
Management seat05
Management seat06
Who we work with
For organisations that cannot afford to stop
Enterprises
One partner for exposure monitoring, perimeter security, hosting and recovery across every subsidiary.
Regulated industries
Evidence and reporting that stand up to auditors, regulators and insurers.
Managed service providers
A multi-client workspace and reports under your own brand.
Digital businesses
Availability through attacks and launches, with infrastructure that grows with you.
Exposure check
Start with your domain
Give us one domain and we will show you what is already exposed: credentials, lookalike domains and open services. No cost, no obligation, and the results are yours to keep.