Identify your exposed vulnerabilities and compromised access points before an attacker can exploit them.
SEE BEFORE YOU ARE SEEN
Most cybersecurity solutions — SOC, SIEM, EDR — detect attacks as they occur.
CYBERESIST® and CYBERCREDS® identify security blind spots proactively by detecting vulnerabilities and compromised access.
You can patch vulnerabilities and revoke compromised access before an attacker exploits them, complementing your existing tools.
IN A NUTSHELL
CYBERESIST
CYBERCREDS
MSP & MSSP
- Our SaaS platforms automate and speed up cybersecurity audits:
- With CYBERESIST, choose sovereign solutions.
- By taking out one of our subscriptions, you ensure regular monitoring with alert management.
- Comprehensive automated audits:
- External attack surface (web) – including data breaches.
- Internal Audit - Active Directory & PKI Infrastructure
- Audit cloud - Azure & Microsoft 365
- Checking for compromised access:
- Public and semi-public sources.
- No interaction with the target systems, the attackers or the compromised data.
- Platforms designed for MSPs and MSSPs:
- You manage your clients directly via dedicated accounts.
- You carry out regular monitoring for your clients.
CYBERESIST : AUDITS AUTOMATISÉS
EXTERNAL ATTACK SURFACE
A map of everything your organisation exposes on the internet — without installing an agent or a sensor, and without collecting your event logs.
- Subdomains, services and Shadow IT,
- Data on the company and its employees.
- Confidential documents, emails, cloud resources, source code,
- Compromised usernames and passwords.
- Email setup,
- Abusive domain name registrations, risks of DNS takeover, website counterfeits.
- Software mapping and configuration errors,
- OWASP Top 10: faulty access controls, obsolete components, insecure design, data and software integrity, identification and authentication, data injection, intelligent password attacks.
Vulnerabilities classified by severity, one recommendation per vulnerability, and a report in French or English — mapping, detailed report and action plan — in PDF, Word and Excel formats.
ACTIVE DIRECTORY
Detection of exploitable technical vulnerabilities and poor administrative practices, providing a clear view of the level of risk.
Exécution d’un outil sur une machine connectée au réseau interne (compte standard).
Identification of poorly protected privileged accounts: Kerberoasting, risky delegations, admin accounts outside Protected Users. Search for vulnerabilities and misconfiguration. Automated detection of potential attack paths.
Verification of critical configuration settings: NTLMv1, anonymous LDAP, SMBv1, Spooler/PetitPotam.
Password management audit: Rotation, RC4, passwords exposed in SYSVOL and network shares.
Mapping attack paths: via ACLs, trusts, and vulnerable PKI templates (ESC1–ESC11).
Assessment of operational resilience: Backups, recycle bin, monitoring, obsolete machines.
Windows workstation audit: password storage in the browser, presence of a password manager, etc.
AZURE ENTRA-ID & MICROSOFT 365
Our module offers a turnkey audit of the cloud environment.
Exécution d’un outil sur une machine avec un compte administrateur du tenant Azure
Identification of poorly protected privileged accounts: Kerberoasting, risky delegations, admin accounts outside of Protected Users.
Access security: MFA, privileged accounts, legacy authentication, break-glass.
Privileges & identities: Admin roles, PIM, apps without owners, main services at risk.
Security posture: Secure Score, EDR/AV, Intune, logs & retention.
Analytics & detection: Risky sign-ins, suspicious activity, unusual connections.
Compliance & resilience: GDPR, retention policies, backup & incident response.
CYBERCREDS: DETECTION OF COMPROMISED ACCESS
DOMAIN INTELLIGENCE
- Compromised services (SSO, SAP, Extranet, VPN…) with their criticality
CRITICAL/HIGH/INFO, - Associated credentials and the identities concerned.
- Subdomains and internal services identified from the logs (authentication portals, WSSO, HR…).
- Continuous monitoring of infostealer logs on Telegram, private markets and underground forums,
- Real-time matching against your domains, email addresses and IP addresses.
- Potentially valid session cookies,
- Risk of session hijacking on critical accounts: SSO, VPN, cloud, Slack, GitHub.
Compromise graph, compromised identities, privileged accesses, password reuse and strength, SaaS stack (Shadow IT), top targeted URLs.
Continuous monitoring, notification within 72 hours at most — within the first hour for critical alerts.
INVESTIGATION
Search the database in real time for a domain or an email address: within seconds you know whether an account is compromised and through which vector — date, URL, username, source file.
Each row opens the full machine profile: date of compromise, country, CRITICAL / HIGH risk analysis, reuse clusters.
Overall exposure, inventory of compromised accounts, remediation plan.
High-risk account (CISO, admin, C-level), classification of an existing SOC alert, post-incident review, onboarding of a sensitive employee.
Structured report — accounts to be reset, machines to be investigated, documented risk, immediate recommendations — presented at a feedback session. Your teams retain the final say on remedial actions.
LEGAL CONTEXT
CYBERCREDS uses only public and semi-public sources.
CYBERCREDS never interacts with target systems, attackers or compromised data.
- We never test the detected access points.
- We process data in accordance with the GDPR
- DPA available
THE ADVANTAGES OF CYBERESIST
Automated audits tailored to the scope and size of the business, using platforms that are very easy to use.
Integrated AI services for personalised, dynamic and scalable audits.
Detailed AUDIT report with a clear management summary to prioritise the ACTION PLAN.
Measurement of discrepancies between AUDITS and ALERT MANAGEMENT FOR NEW VULNERABILITIES for continuous monitoring.
State-of-the-art technology combined with an orchestrator that integrates a wide range of services.
How Cybercreds is used
The latest cybersecurity projects
External SOC at an MSSP
A client employee infected with an infostealer.
An employee’s log was circulating on Telegram.
The user’s credentials granted access to the client’s VPN.
The SOC couldn’t see it because it was outside the managed scope.
What the MSSP has gained from CYBERCREDS:
- External visibility that the EDR did not have.
- A proactive alert that justified the annual client contract.
- Invoice issued in response to an incident.
in-house SOC at a client's premises
Receipt of an alert
An analyst detects a VPN connection from an unusual country. He opens a ticket and checks his SIEM — nothing out of the ordinary on the network side, so he closes the alert: “Unusual behaviour, to be monitored”.
What he didn’t know was that, three weeks earlier, this employee’s personal computer had been infected by a keylogger. His VPN credentials were in a Telegram log.
CYBERCREDS is said to have sent a webhook to its SIEM containing the full context three weeks before the alert:
- The analyst reportedly had: machine, date, infostealer family, exposed credentials.
- A quick assessment in five minutes rather than a detailed investigation without context.
