Digital risk protection · How it works
A managed service, from the first lookalike domain to the takedown
You do not get a console and a login and a list to work through. You get analysts who find what is being built against you, check it, and remove it, and a report on what they did. Your part is to tell us what to protect and to decide, once, how much we may act without asking.
Five stages, and a page for each one
Each stage has its own page. What follows is what happens in it, and the one thing it needs from you.
| Five stages, and a page for each one | What you do | |
|---|---|---|
| 01 · Onboard | Your digital footprint is mapped into scope: domains, brand names, logos, apps, social accounts, executives. | Fill in a questionnaire, supply trademark documents, choose a takedown policy. |
| 02 · Detect | Passive DNS, the web, social media, app stores, criminal chat groups and the dark web are collected continuously. Machine scoring ranks findings and removes the obvious noise. | Nothing. |
| 03 · Validate | An analyst reviews each finding, removes false positives, and adds context and a recommended action. | Read the alert. |
| 04 · Remove | Blocking, takedown requests to registrars, hosts, platforms and app stores, escalation, and monitoring in case the threat returns. | Approve the takedown, or let a standing order cover it. |
| 05 · Report | Real-time alerts, weekly blocklists, intelligence summaries and a monthly report. | Feed the blocklists into your own tools; read the monthly report. |
Who does what
Three parties are involved, and it is worth knowing which one does what before anything is found.
BlueVoyant
Runs the platform, the data collection and the analysts. Their analysts review findings and file takedowns during business hours, and at weekends when a case is urgent; their threat intelligence team writes the weekly and monthly reports. The portal and everything the analysts write are in English.
Spirity
Holds your contract and is your first line of support. Our desk runs from 07:00 to 21:00 Central European Time, with high-severity cases covered seven days a week. We are the escalation point for anything urgent or outside the standard flow, and we walk you through the reports in Hungarian or German.
You
Tell us what to protect, provide trademark documents once, and decide how takedowns are approved. Anything that changes inside your own systems stays with you: resetting a leaked password, blocking a domain on your gateway, revoking a session.
How long it takes to start
- Within two business days of the order: you receive the onboarding questionnaire and a certificate-of-authority template. It asks for the brands and assets to watch and the contact details of your portal users, and takes about 10 to 15 minutes. Depending on the package, it asks for a little more, such as private email addresses you want monitored.
- When it comes back: with the certificate of authority, trademark documents and logos, the service starts. Collection runs from the first day.
- One to two weeks: the profile is built and the searches are configured.
- Kick-off meeting: a walkthrough of the portal and the service, and portal access with multi-factor authentication for your named users.
- The first 14 days live: a tuning period, in which the searches are adjusted with your feedback until the output is accurate rather than noisy.
On average, it is two to three weeks from order to live service. The 14-day tuning period follows go-live.
What runs around the clock, and what needs a person
Machines and people keep different hours, and we would rather you knew which is which before you buy.
Searching and alerting run around the clock, every day, for every covered source: domains, websites, social media, app stores, chat groups, the dark web and breach data. The analysts’ work, confirming findings, filing takedowns and answering your requests, happens during business hours, and at weekends when a case is urgent. So an alert raised outside those hours reaches you as soon as it is detected, before an analyst has reviewed it; the review follows when the analysts are next working.
| Finding | Searched and alerted | Notification after detection |
|---|---|---|
| Phishing websites | Around the clock | Within 30 minutes |
| Compromised credentials | Around the clock | Within 30 minutes |
| Compromised payment cards | Around the clock | Within 24 hours |
| Rogue mobile apps and fake social media accounts | Around the clock | Within 24 hours |
| Data leakage | Around the clock | Within 24 hours |
Every alert carries a unique case ID, which follows it through the portal, the email and the takedown.
Where this stops
It does not watch inside your network. Everything here happens outside your estate. Detection and response on your own endpoints, identities and cloud is a separate service.
It cannot promise that a site comes down. We commit to filing and pursuing every takedown. Whether a domain is suspended is the registrar’s decision, and some cases, such as domains that only redirect to another site, succeed less often. The takedown page sets out what can and cannot be removed.
It does not talk to criminals unless you ask. Analysts can engage a threat actor to confirm what is on offer, but only for a specific case you have agreed to in advance.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
No. The service watches the internet, not your network, so there are no agents, no connectors and no access to your systems. Three optional integrations can make detection faster: a short script on your login page, forwarding your abuse mailbox, and sharing referral logs. Each uses something you already run.
Very little after onboarding. With a standing takedown order, most findings are handled without anyone on your side doing anything, and you read about them afterwards. Without one, someone has to approve each takedown in the portal or by email. Either way, an analyst checks every alert; one raised out of hours reaches you first and is reviewed when the analysts are next working.
Spirity. Our desk runs from 07:00 to 21:00 CET, and high-severity cases are covered seven days a week. We carry the case into BlueVoyant’s operations team rather than leaving you to find the right contact.
The rest of the service
Onboarding
What we need from you to start, and the two to three weeks from order to live service.
Detection
Passive DNS, criminal chat groups, the dark web, app stores and breach data, ranked before an analyst looks.
Takedown
Three layers of removal, unlimited takedowns, and an 18-hour median for phishing sites.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.