Exposure Intelligence Layer

What attackers see when they look at you from the outside.

Your attack surface extends far beyond the assets you actively manage. Subdomains you forgot about. Cloud storage with public ACLs. Credentials leaked in breaches. Mentions on dark web forums. Third-party services with access to your data.

SPNT's Exposure Intelligence Layer continuously monitors what's visible from the outside — and correlates it with your internal security state in the substrate.

What the layer monitors

• External attack surface. Internet-facing assets, exposed services, shadow IT, forgotten subdomains, cloud resources with public exposure.
• Credential exposure. Leaked credentials from data breaches, paste sites, dark web marketplaces. Correlated to your identity systems.
• Brand impersonation. Phishing domains, typosquatting, fake social media accounts, fraudulent apps impersonating your brand.
• Dark web monitoring. Mentions of your organization, leaked data, access being sold, attack planning discussions.
• Supply chain exposure. Third-party vendors with access to your data, their security posture, breaches affecting your supply chain.

Credential leak response

When credentials linked to your domain appear in a breach dump, the Exposure Intelligence Layer:

1. Detects — identifies the exposed credential set and source.
2. Correlates — matches email addresses to identities in your identity providers (via NADZOR integration).
3. Creates finding — writes a substrate finding with severity based on the account's access level.
4. Triggers response — can automatically trigger password reset workflows via integration.

The finding flows through normal substrate processing — prioritization, governance mapping, investigation context.

Attack surface correlation

External exposure findings are correlated with internal vulnerability state. A publicly exposed service with a critical unpatched vulnerability is prioritized higher than either signal alone would suggest.

This correlation happens automatically in the substrate. ISTRAGA reasons about the combined exposure. REGULATIVA maps to relevant compliance obligations (external scanning requirements, incident response).