Outside-in monitoring

How it works

An outside-in approach starts with what can be learned from outside: a company name, a domain, public records, breach corpora and leak databases. Nothing is deployed on the customer's systems. The customer grants no access to email, endpoints or identity providers.

This is the opposite of inside-out tooling such as endpoint agents, log collection and identity-provider integrations, which see activity within the organization but only the activity that passes through them.

What outside-in monitoring shows

An outside-in view answers the questions an attacker would also ask: which people are associated with the company, which of their records appear in known breaches, what data types were exposed and how recent the breaches are.

A result is evidence of exposure in source data, and it gives the security team a ranked starting point. Confirming whether an exposed password is still valid, or whether a device is infected, happens inside the organization, with the priorities already set.

How it applies to executive exposure

CEM is an outside-in product: it discovers executives from a company name, searches breach corpora and leak databases, and ranks each person's findings by what to fix first, using factors published on the methodology page. Nothing is installed. The findings describe exposure in breach data, based on the records found when the person was scanned. EDG3 is the companion product for leaked data: it watches dark web forums and marketplaces, Telegram and other channels.

Outside-in monitoring starts from a company name, needs no installation or internal access, and returns first findings within minutes. Credential leak monitoring goes through what that means in practice.

Reducing the risk

Use outside-in results as a prompt for action. Reset exposed credentials, check where the same password was reused, and enable multi-factor authentication. Pair the view with inside-out controls, because each sees what the other cannot.

How it differs from related terms

Executive attack surface is the thing being examined. Outside-in monitoring is one way of examining part of it. NIST defines an attack surface as the set of points on the boundary of a system, a component or an environment where an attacker can try to enter, cause an effect on, or extract data from. An outside-in view reaches only the points visible from outside.