Digital risk protection · Reporting
What lands on your team’s desk
The output of this service is not another console for somebody to watch. Findings arrive validated, with context and a recommended action, and in formats your existing tools can use. The weekly blocklist is ready for your own gateway; the monthly report is written for management.
Six deliverables, at their own rhythm
| Deliverable | Frequency | How your team uses it |
|---|---|---|
| Real-time alert | As found | A validated finding with evidence, risk and a recommended action. Approve the takedown in one click. |
| Indicator list | Weekly | Malicious domains, URLs and IP addresses for your SIEM, email gateway, proxy and firewall blocklists. |
| Intelligence summary | Weekly | Campaigns and threat actors relevant to your organisation and your sector. |
| Threat landscape report | Monthly | Trends, takedown statistics and KPIs for management reporting. |
| Portal and API | Continuous | Portal: case history, takedown status, three user roles and multi-factor authentication. API: authenticated access from allow-listed IP addresses. |
| Customer success manager | Ongoing | A named BlueVoyant contact, plus your Spirity contact for support and walkthroughs in Hungarian or German. |
The weekly indicator list is the one most teams underestimate. It turns external findings into internal blocking rules: if your team loads it, a lookalike domain found on Monday can be blocked on your mail gateway by the end of the week, whether or not its takedown has finished.
Alerts, and how fast they come
An email alert goes out within 30 minutes of a phishing website or a compromised credential being detected. Alerts on compromised payment cards, rogue apps, fake social media accounts and data leakage go out within 24 hours. Each carries a unique case ID, which links the email to the case in the portal and to any takedown that follows.
The portal
- Dashboard of detections, incidents and takedowns over time, by type and by brand.
- Case view with the evidence, the infrastructure details and the current status.
- Takedown requests and comments in the same place, so the conversation about a case stays with the case.
- Reports archive, with the intelligence summaries and monthly reports.
- Support: service requests to the analysts or the customer success manager.
There is no limit on the number of users. Each has one of three roles. Admins manage users and can do everything else. Editors can request takedowns, open service requests and comment. Viewers can see everything and change nothing. Admins add and remove users, reset passwords and multi-factor authentication, and export the user list.
The API
For teams that would rather not log in to another portal, the API exposes the same service.
- View alerts for each type of incident, with the detail as JSON.
- Act on cases: add comments and take actions on open cases.
- Open service requests: a general question, or a specific investigation request.
- Download intelligence reports.
Typical uses are pulling new alerts into a SIEM or SOAR, opening a ticket in your own system when a high-severity finding arrives, and archiving reports automatically. Access is authenticated and restricted to allow-listed IP addresses.
What management sees
The monthly threat landscape report gives management what it usually asks for: how many threats were found, how many were removed and how fast, what is trending in your sector, and what changed since last month. Your Spirity contact can walk management through it in Hungarian or German.
Where you run a security programme with us, the same figures feed it. External threats and takedown statistics belong in the risk picture alongside everything else, not in a separate report nobody reconciles.
Executive Cyber Guard reports
Executive protection reports differently, because the subject is a person rather than a brand. A baseline report on each executive’s digital footprint is delivered within a month of the start, followed by at least one report a month, sent as encrypted PDF files. After each report, an analyst is available for a video call to go through it.
Where this stops
The portal and the reports are in English. That includes the intelligence summaries and the monthly report. What is localised is the layer around them: your Spirity contact and the walkthroughs.
An indicator list only helps if somebody loads it. We deliver it weekly; putting it into your gateway, proxy or firewall is a change in your systems and stays with your team or your IT provider.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
Yes, in two ways. The weekly indicator list can be loaded into your SIEM and blocklists, and the API lets your SIEM or SOAR pull alerts as they are raised.
As many as you need: there is no cap on portal users. Each has an admin, editor or viewer role, and your admin can add, change and remove users without asking us.
The monthly threat landscape report is written for management: threats found, takedowns completed and their speed, sector trends and KPIs. We can walk your management through it in Hungarian or German.
Choose what to protect
Brand impersonation
Lookalike domains, phishing sites, fake social media profiles and rogue apps, found and taken down.
Dark web monitoring
Leaked credentials, fraud campaigns, stolen payment cards and leaked documents, each checked by an analyst.
Executive protection
Executive Cyber Guard maps each executive’s footprint and requests the takedown of impersonation.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.