DeepSight watches the open, deep and dark web for exposure that belongs to you — leaked credentials, look-alike domains, forgotten internet-facing assets — and hands your team a short, ranked account of what actually matters this week.
DeepSight is a managed external threat intelligence service for organisations in the Philippines. It runs on Cognyte's LUMINAR platform, which supplies the collection and detection engine across open sources, social platforms, deep and dark web forums, paste sites, stealer-log markets and the public internet. Shieldtech analysts supply the part a platform cannot: severity ranking against your business, written context, and a clear recommendation about what to escalate.
Most organisations do not have a visibility problem at the perimeter. They have a volume problem outside it. A raw external feed produces more signals in a week than a four-person IT team can read, and almost none of them arrive with an answer to the only question that matters — is this ours, and does it need someone tonight?
Dark web markets, stealer logs, paste sites, breach dumps, criminal forums, social platforms, certificate transparency logs, the public internet.
Collection and detection by LUMINAR. Validation, deduplication, severity ranking, business context and written analysis by DeepSight.
Receives escalation-ready intelligence. Retains validation, decision, response and remediation.
The blue edge marks the handoff. Everything to the right of it stays with you.
Gartner groups these three capabilities under continuous threat exposure management. In practice they answer three different questions, and most organisations need all three before the picture makes sense.
WHO IS LIKELY TO COME FOR YOU, AND HOW
Threat actor tactics, techniques and procedures relevant to your sector. Indicators of compromise you can push into your own tooling. Campaign tracking across Philippine and regional targets.
WHAT OF YOURS IS ALREADY OUT THERE
Monitoring for your data, your brand and your people in places you cannot reasonably watch yourself — stealer-log marketplaces, criminal forums, Telegram channels, typosquat registrations.
WHAT YOU ARE ACTUALLY EXPOSING
Discovery of internet-facing assets from the attacker's vantage point, including the ones nobody inventoried — a regional office portal, a vendor-built microsite, a certificate nobody renewed.
Alert fatigue is the failure mode this service exists to prevent, so the outputs are deliberately few and deliberately timed. Exact thresholds and service levels are agreed during scoping.
| Output | Frequency | Written for |
|---|---|---|
| Critical alert | On detection, to an agreed service level | Your named escalation contact and security lead |
| Weekly threat summary | Weekly | IT and security operations |
| Monthly executive briefing | Monthly | CIO, CISO or equivalent |
| Quarterly leadership review | Quarterly | Executive committee, risk committee |
| Annual posture report | Annually | Audit, board, regulator-facing files |
| Requests for information | On demand, within an agreed allowance | Whoever asked the question |
Every critical alert carries the same four things: what was found, where it was found, why we ranked it the way we did, and what we would do next if it were ours. No alert leaves us without a named analyst behind it.
The difference between the tiers is not how much data you get. It is how far into your workflow the intelligence travels.
FOR ORGANISATIONS WITH A SMALL IT TEAM AND NO DEDICATED SECURITY FUNCTION
Continuous monitoring across the three coverage domains, with signals filtered, prioritised and delivered as scheduled written intelligence. The value here is noise reduction: you stop paying attention to everything and start paying attention to a ranked list.
FOR ORGANISATIONS WITH AN OPERATING SECURITY OR SOC FUNCTION
Everything above, plus enriched alerts routed into your existing investigation workflow, analyst-to-analyst support during investigations, and joint refinement of your escalation playbooks and templates. Our output is shaped to fit the way your team already works rather than the other way round.
FOR EXECUTIVE TEAMS, BOARDS AND RISK COMMITTEES
Everything above, plus threat landscape briefings written for a governance audience, support for board and regulator reporting, and input into security planning cycles. The question shifts from what happened this week to what we should be preparing for this year.
Pricing and coverage are driven by the number of entities we track for you, not by seat count or data volume. A monitored asset is any one of the following:
We run a passive discovery pass against your public footprint and bring you the findings — exposed assets, expired certificates, credentials already circulating, look-alike domains registered against your brand. No agents, no internal access, nothing installed. Most organisations find something in this conversation they did not know about.
We turn the scan into a monitored asset register with you, agree priority intelligence requirements, name escalation contacts, and set service levels for critical alerts. This is where the shape of the engagement is decided.
Data Processing Agreement and retention schedule executed, access provisioned, reporting recipients confirmed. Onboarding runs alongside, not after.
The first month is deliberately noisy on our side and quiet on yours: we tune severity thresholds against your actual environment so that by week five, a critical alert from us means something specific. We review that tuning with you before it settles.
No. DeepSight is entirely external. We do not install agents, connect to internal systems, or hold credentials to your environment. Everything we see, an attacker could also see — that is the point of the service.
Your SOC sees what reaches your perimeter. It cannot see your credentials being sold in a stealer-log market three weeks earlier, or a domain registered last night to phish your customers. DeepSight covers the window before anything touches your infrastructure, and feeds what it finds into the tooling you already run.
Only with written consent, and never in connection with a specific finding. We publish no client data, no live breach detail and no named incidents.
Cost scales with the number of monitored assets and the engagement tier. We quote after the scoping step, because a number produced before asset validation is a guess. Public sector buyers should note that any figure we provide ahead of a formal procurement is indicative and non-binding, offered for market scoping reference only.
A named Shieldtech analyst reviews and signs every scheduled report and every critical alert. Automation does the collection and the first-pass filtering. The judgment is human, and you can ask that person questions.
The fastest way to find out whether this service is worth your money is to let us look at your external footprint and show you what came back. It costs you a meeting.