Digital risk protection · How we compare
Four ways to buy this, and what each leaves with you
Digital risk protection is sold in very different shapes under similar names. Some products are feeds that tell you about threats. Some block threats in browsers but never remove them. Some are managed services that count every takedown. The differences matter more than the feature lists, because they decide how much work stays with your team and what a bad month costs.
The four approaches
| Threat intelligence platform | Virtual takedown service | Managed service with quotas | Spirity × BlueVoyant | |
|---|---|---|---|---|
| Brand impersonation coverage | Partial; raw matches, with triage left to you | Partial | Depends on the vendor and package | Web, social media and apps, monitored continuously |
| Deep and dark web | Partial; findings often too general to act on | Not covered | Limited access; little engagement | Criminal chat groups and dark web monitored around the clock, with threat actor engagement on request |
| Takedown | Little or none, or a small quota | Blocking only: protects users whose browser or security software uses the warning list | Limited quota | Unlimited, at server level, plus blocking |
| Ad-hoc investigation | Not included, or extra cost | Not included | Limited | Unlimited investigation requests through the portal |
| Who does the triage | Your analysts | Your team decides what to submit | Shared | The service’s analysts; out of hours, after the alert |
| Cost profile | Licence fee, plus your analysts’ time on triage | Lower fee; blocking only | Quota-based fee; extra cost when a campaign exceeds the quota | Fixed annual fee; takedowns never add to it |
Categories of approach, not named products. We will go through a named comparison with you using current public information.
Why unlimited takedowns keep your cost flat
Takedowns are often sold in packages, for example of 50. That looks fine until a campaign arrives. One bank faced an SMS phishing campaign in which 492 phishing websites were detected and taken down. On packages of 50, if each takedown uses one unit, that single campaign would have needed ten packages. Under a flat fee, the takedowns themselves add nothing to it.
The cost line of a package model is a staircase that climbs with every campaign. The cost line of a flat fee is flat. The months when you most need takedowns are exactly the months a package model costs most.
Seven questions to ask any vendor
- Are takedowns capped? If so, what happens in the month you need more?
- Is a takedown a removal or a browser block? Blocking alone leaves the site live for everyone whose browser does not use the warning list.
- Does detection rely on domain registrations? Ask how they find phishing on subdomains of site builders, and behind search ads.
- Who reads the alerts before you do? Ask for the false-positive rate on alerts that reach the client, not on raw detections.
- Which closed communities do they watch, and how do they get in?
- Are social media and apps included, and on which platforms? Ask how often they are searched.
- Who do you call? In which language, in which time zone, and who holds the contract.
What we would point to
- Unlimited takedowns across web, social media and apps, included in one annual fee.
- Alerts checked by an analyst, with under 1% false positives as measured by BlueVoyant over 12 months.
- Visibility most brand protection tools lack: passive DNS, more than 3,000 criminal chat groups, and threat actor engagement on request.
- Removal at the source, with established contacts at more than 600 registrars and 200 app stores, and an 18-hour median takedown time for phishing sites.
- A local partner. Your contract is with Spirity, your first call is answered in Hungarian or German, and the service fits alongside your SOC and your NIS2 risk management.
Where this stops
It is not the cheapest option. A browser-blocking service costs less. It also does less, and the difference shows up as phishing sites that stay online.
It is not built for counterfeit goods. If your main problem is counterfeit products on marketplaces, a marketplace-focused IP enforcement service may fit better, and we would rather say so.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
Because packages change faster than web pages, and a comparison that was true last year is unfair this year. If you are comparing specific vendors, ask us, and we will go through the comparison with you using their current public information.
Your headcount, which sets the package. The number of domains is unlimited, and so is the number of takedowns — neither is a pricing variable. Each package covers a set number of brands and executives, and that allowance is sized to cover what an organization of your size normally needs. Where it does not, a small upgrade option fine-tunes the coverage to fit. Twelve-month term, paid annually. The overview page carries the full answer, including why headcount is the variable we size on.
Related pages
Takedown
Three layers of removal, unlimited takedowns, and an 18-hour median for phishing sites.
Use cases
Four cases and five attack patterns, from lookalike invoice domains to search-ad phishing.
Validation
Every finding is reviewed by an analyst: false positives removed, evidence attached, an action recommended.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.