Cybersecurity / Digital Risk Protection / EASM
AEGIS DRP
Digital risk protection platform: external attack surface, brand impersonation and leaked credentials
An organization’s exposure does not stop at its firewall: look-alike domains, forgotten subdomains, expiring certificates and credentials indexed on the public web appear outside its perimeter, where nobody is watching. AEGIS DRP monitors that outside view, detects what is wrong, and lets a security team investigate and drive remediation from one place.
- 4 detection engines: typosquatting, attack surface, brand mentions, leaked credentials
- 21 finding types in the detection model, across 5 severity levels
- 12 takedown targets referenced: registrars, hosts, social networks, app stores
- Status
- In production
- Model
- B2B
- Market
- Canada
The problem
Security teams have good tools for what happens inside the network and very little for what happens outside it: a typosquatted domain that starts resolving, a subdomain nobody remembers, a login page that borrows the brand, a password dump indexed by a search engine. Each of these is found late, by chance, and handled by email — with no inventory, no history and no case to attach the evidence to.
The solution
A multi-tenant platform that gives each organization an inventory of its external attack surface and four on-demand detection engines, then treats every detection as an alert that can be qualified, escalated into a case with a status pipeline and comments, and turned into a takedown request drafted against a catalogue of registrars, hosts and platforms. A conversational copilot helps the analyst read a finding and plan next steps. Next on the roadmap: persisting the results of scheduled scans, submitting takedown requests to the target directly from the platform, and outbound notifications.
What the platform does
- Attack-surface inventory Eleven asset types — domains, subdomains, IP addresses, certificates, applications, vendors and more — with criticality, search and filters, added by hand or imported from a scan with deduplication.
- Typosquatting detection Generates up to 200 permutations of a domain with seven techniques (omission, transposition, adjacent keys, doubling, homoglyphs, alternative TLDs, hyphens) and resolves them in batches over DNS to find the ones that are live.
- External surface scan DNS records, subdomain discovery from web crawling and common prefixes, TLS certificate check with an expiry grade, and a screenshot of the public site — without touching the target beyond public lookups.
- Brand and credential monitoring Web searches for pages that reuse the brand on login or fraud-related pages, and for indexed credential dumps, paste sites and breach mentions; results are deduplicated and classified by severity.
- Alerts and cases Every finding carries a type, a severity, a confidence and a status; an analyst qualifies it, marks it as a false positive or opens a case with a priority derived from the severity, a six-step status pipeline and a comment thread.
- Takedown drafting Takedown requests drafted against a catalogue of twelve target categories with their abuse channels, linked to the finding and kept with the case for follow-up.
- Command Center and reports A dashboard with a weighted risk score, 14-day trend, severity breakdown and top finding types, plus an 8-week reporting view — all computed from the tenant’s real data.
- Threat-intel notes and hunting Indicators of compromise in twelve types recorded by the analyst, and a hunting view that searches indicators, assets and findings across the tenant.
Architecture
Cloud SaaS: a React single-page application over a PostgreSQL backend with row-level security isolating every table by organization; stateless server-side functions run the four scans and return their results to the analyst, who decides which ones become alerts; daily scheduled scan runs; a streaming AI copilot relayed by a server-side function so that no provider key reaches the browser. Thirty-five tables organized in five domains: multi-tenant foundation, attack surface, detection, response and evidence, threat intelligence.
Who uses it
Security analysts and SOC teams of organizations exposed online, and the CISO or executive who reads the Command Center. French-language interface.
Markets
Canada first, for organizations of any size that own a brand and a domain portfolio; multi-tenant by design, so a managed security provider can operate it for several clients.
Where AI fits — and where it does not
AI is a copilot, not a detector. The four engines are deterministic — DNS resolution, web search, keyword classification and a weighted risk score — so every finding can be traced to a rule. The copilot is a conversational assistant backed by a cloud-hosted large language model reached through a third-party gateway: conversations are sent to that provider, the copilot has no access to the tenant’s data and takes no action on the platform. Its answers are advice for the analyst, who remains responsible for every decision.
My role
Founder, architect and product designer: threat model, data model, platform architecture and technical direction; my team at SOFT M POWER CANADA built it and operates it under my direction.