Shadow ITShadow IT discovery
Find what nobody put on the list.
Marketing launches a microsite with an agency. An engineer spins up a test box with a public IP to debug something on a Friday. A vendor hosts a portal under your brand on infrastructure you have never seen. None of it is malicious and none of it is on the inventory. Nulink runs passive OSINT alongside its own discovery, compares what the internet knows about you with what you have confirmed, and hands you the difference.
What it finds
- Hosts answering under your domains from providers you have no account with
- Third-party hosting and SaaS tied to your brand by DNS or certificate
- Forgotten test, demo and staging environments that outlived their project
- Exposed admin panels, default installation pages and directory listings
- Staff email addresses published on the open internet, which is where phishing lists come from
- Sites and pages that reference you but run entirely outside your estate
Where the data comes from
- theHarvester OSINT
- Passive DNS
- Certificate transparency logs
- Web crawling
- Web archives
- GeoIP
How it works
- 01
Discover
Your external surface is mapped from your verified domains outward, with passive OSINT running alongside.
- 02
Compare
Discovered assets are checked against the ones you have already confirmed as known and accounted for.
- 03
Surface
Anything unaccounted for is raised with where it is hosted, what it runs and how it was found.
- 04
Resolve
Claim it, secure it or shut it down, and record the decision against the finding so it stays decided.
In detail
- Passive, by design
- Shadow IT discovery reads what has already been published: search indexes, public records, certificate logs, archived pages. It does not touch systems to find them, which matters when the system in question belongs to an agency you have no contract language with.
- Staff addresses count as surface
- The same sweep that finds hosts finds email addresses published on the open internet. Those addresses are what ends up in phishing target lists and, eventually, in breach data. Knowing which of them are exposed is the first half of doing something about it.
- Hosted elsewhere, still yours
- Hosting provider and GeoIP location sit on every asset, so it is immediately obvious when something under your brand answers from a provider nobody at your company has an account with. That is usually an agency, and occasionally it is not.
- Evidence for a difficult conversation
- Telling a team they have exposed something goes better with the certificate, the DNS record and the response attached. Nulink gives you the proof rather than the suspicion.
What changes for your team
No blind spots
The asset that gets you breached is almost always the one nobody knew was running.
Fewer forgotten environments
Test systems stop living on the internet indefinitely because nobody remembered to turn them off.
Better conversations
Show a team what they have exposed with evidence attached, not with an accusation.
What it doesn't do
Every tool has edges. Knowing where ours are is the difference between a control you can rely on and one you only think you have.
- Nulink can tell you an asset is unaccounted for. Deciding whether to claim it, secure it or take it down is yours.
- Assets with no DNS, certificate or published relationship to your verified domains will not be found this way.
Questions about Shadow IT discovery
Does OSINT collection touch the systems it finds?
The collection itself does not: it reads published records and indexes. Once a host is discovered and sits under one of your verified domains, it is treated like any other asset and is scanned alongside them.
An agency runs one of these sites. Can we still have it assessed?
If it answers under a domain you have verified, it is in scope and it is already being checked. If it sits on a domain the agency owns, that domain needs verifying on its own, which is a conversation worth having before the contract renews.
How is this different from asset discovery?
Same machinery, different question. Asset discovery builds the inventory. Shadow IT discovery is what you get when you subtract the assets you already knew about from it.
Certificates and TLS
TLSWatch every certificate issued in your name, and check what your servers actually negotiate.
Read more
Ports, services and CVEs
ServicesSee which ports answer on your hosts, what runs behind them, and which versions have known CVEs.
Read more
Web exposure checks
WebCheck the headers, cookies, CORS policies and technology stack in front of every site you run.
Read more
Visibility is security. Start with yours.
Book a 30-minute walkthrough with the team, or connect your first account and see results today.