Regulatory Exposure

5 automated security scanners

Public Records Request Exposure

Purpose: The Public Records Request Exposure Scanner is designed to identify potential regulatory exposures and compliance issues by detecting state/local government disclosures, contract details, public sector documents, breach mentions, and tech stack disclosure related to a specified domain and company name. This tool helps in identifying areas where the organization may need to improve its security posture or comply with regulations.

What It Detects:

State/Local Government Disclosures: Identifies mentions of specific state or local government agencies and looks for references to regulatory filings or audits by these entities.
Contract Details: Searches for terms related to contracts, agreements, and procurement processes, detecting mentions of vendors, suppliers, and service providers.
Public Sector Documents: Identifies links to public sector documents such as RFPs (Request for Proposals), RFIs (Request for Information) and references to compliance reports and regulatory submissions.
Breach Mentions: Detects specific phrases indicating data breaches, security incidents, unauthorized access, or compromised information using real regex patterns.
Tech Stack Disclosure: Identifies mentions of technology stacks used by the company, looking for terms related to cloud services (AWS, Azure, GCP), DevOps tools (Terraform, Ansible, Docker), and monitoring solutions (Splunk, Datadog, Elastic).

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps organizations proactively identify potential regulatory issues, ensuring compliance with state and local government requirements. It also aids in assessing the security posture by highlighting areas of concern such as data breaches or unauthorized access incidents.

Risk Levels:

Critical: Conditions that directly lead to severe legal consequences, significant financial loss, or substantial damage to reputation should be considered critical.
High: Conditions that could lead to medium to high risk scenarios, potentially causing significant disruptions or exposing sensitive information.
Medium: Conditions that may lead to minor risks but still require attention and improvement in processes or controls.
Low: Informative findings that do not pose immediate risks but can be useful for strategic planning and continuous improvement.
Info: General informational findings that provide insights into the company’s public records and digital footprint without significant risk levels.

If specific conditions are not mentioned in the README, infer them based on the scanner’s purpose and impact.

Example Findings:

The scanner might flag a mention of “Acme Corporation” being audited by the Securities and Exchange Commission, indicating potential regulatory exposure.
It could also detect an outdated version of PCI DSS compliance in a contract mentioning payment processing services, which is critical for maintaining secure transactions.

Regulatory Investigation Documents

Purpose: The Regulatory Investigation Documents Scanner is designed to identify and analyze publicly available documents such as SEC filings, LinkedIn profiles, GitHub repositories, news articles, job boards, and breach history to ensure companies are adhering to legal and regulatory standards. This tool helps in detecting potential breaches, tech stack disclosures, certification claims, regulatory testimony, and compliance evidence that may indicate non-compliance with laws and regulations.

What It Detects:

Breach Mentions: Identifies mentions of data breaches, security incidents, unauthorized access, and compromised information through patterns such as “data breach”, “security incident”, “unauthorized access”, and “compromised”.
Tech Stack Disclosure: Detects mentions of specific technologies used by the company which can indicate compliance with regulatory requirements. Examples include AWS, Azure, GCP, Kubernetes, Terraform, Ansible, Docker, Splunk, Datadog, and Elastic.
Certification Claims: Identifies claims of compliance with certifications like SOC 2, ISO 27001, PCI DSS, and HIPAA through patterns such as “soc 2”, “iso 27001”, “pci dss”, and “hipaa compliant”.
Regulatory Testimony: Detects mentions of regulatory testimony, submissions to agencies, and compliance reports.
Compliance Evidence: Identifies documents that provide evidence of compliance with legal and regulatory requirements through patterns such as “compliance evidence”, “legal documents”, “regulatory documents”, and “audit report”.

Inputs Required:

domain (string): The primary domain to analyze, for example, “acme.com”.
company_name (string): The company name used for searching relevant statements, such as “Acme Corporation”.

Business Impact: This scanner is crucial for maintaining legal and regulatory compliance by identifying potential risks early in the investigation phase. It helps organizations ensure that they are transparent about security incidents and data breaches, which can impact trust among stakeholders and may lead to fines or legal repercussions if not managed properly.

Risk Levels:

Critical: Conditions that directly indicate severe non-compliance with regulations, such as explicit mentions of significant data breaches in public documents.
High: Conditions indicating high risk, like unaddressed security incidents or lack of disclosure about using critical technologies for compliance purposes.
Medium: Conditions where compliance is questionable but not immediately critical, such as ambiguous language around technology usage without clear evidence.
Low: Informal mentions that do not directly indicate non-compliance but could be part of a broader strategy for transparency and compliance.
Info: General information about the company’s tech stack or regulatory history that does not significantly impact compliance status.

Example Findings:

The company has been mentioned in multiple articles discussing unauthorized access attempts, indicating potential security vulnerabilities.
The company claims to be PCI DSS compliant but lacks specific details on how this is achieved, requiring further investigation into the tech stack and processes used for compliance.

Whistleblower Disclosure Impact

Purpose: The Whistleblower Disclosure Impact Scanner is designed to identify potential regulatory exposures by analyzing publicly available information such as GitHub repositories, LinkedIn profiles, news articles, job boards, and SEC filings. This tool helps in detecting internal document leakage, process documentation exposure, and policy revelations that could lead to legal issues.

What It Detects:

Breach Mentions: Identifies mentions of data breaches, security incidents, unauthorized access, and compromised systems through patterns such as data breach, security incident, unauthorized access, and compromised.
Tech Stack Disclosure: Detects disclosures of specific technology stacks used by the company, which can indicate potential vulnerabilities or compliance issues. Examples include AWS, Azure, GCP, Kubernetes, Terraform, Ansible, Docker, Splunk, Datadog, and Elastic.
Certification Claims: Identifies claims of compliance with specific certifications that are crucial for regulatory adherence, such as SOC 2 Type I/II, ISO 27001, PCI DSS, and HIPAA compliance.
Subdomain Discovery: Discovers subdomains associated with the company’s domain to identify potential entry points or sensitive information exposure using Certificate Transparency logs.
Breach History: Checks for breach history using the HaveIBeenPwned API to determine if the company has been involved in known data breaches.

Inputs Required:

domain (string): The primary domain to analyze, such as acme.com.
company_name (string): The company name for statement searching, such as “Acme Corporation”.

Business Impact: This scanner is crucial for organizations as it helps in identifying potential regulatory exposures that could lead to legal issues and affect the organization’s security posture. It aids in detecting internal document leakage, process documentation exposure, and policy revelations which are critical for maintaining a secure environment.

Risk Levels:

Critical: Conditions where there is direct evidence of unauthorized access or data breaches that have not been disclosed internally.
High: Conditions where the company has been associated with known data breaches but no public disclosure has been made.
Medium: Conditions where there are indications of potential vulnerabilities in technology stacks used by the company.
Low: Conditions where minor compliance issues or inconclusive evidence of regulatory non-compliance are detected.
Info: Conditions where informational findings such as disclosures of specific technology stacks or certifications are identified but do not directly impact critical security aspects.

Example Findings:

The company claims to be PCI DSS compliant, but no detailed documentation on compliance is available publicly.
Subdomains discovered include support.acme.com, which might indicate a potential exposure point for customer support information.

FOIA Request Monitoring

Purpose: The FOIA Request Monitoring Scanner is designed to identify potential regulatory risks and ensure compliance with legal requirements by analyzing publicly available data sources such as government filings, regulatory submissions, and breach disclosures. This tool helps organizations detect exposure in areas like SEC risk factor disclosures, cybersecurity incidents, and technology stack usage that may indicate compliance or adherence to specific standards.

What It Detects:

Government Filing Exposure: Identifies mentions of SEC filings, including risk factor disclosures related to regulatory risks.
Regulatory Submissions: Detects patterns indicating certification claims such as SOC 2, ISO 27001, PCI DSS, and HIPAA compliance.
Compliance Documentation: Searches for breach mentions in news articles, job boards, and other public sources that indicate unauthorized access or data breaches.
Technology Stack Disclosure: Detects mentions of technology stacks used by the company, which can signal proficiency in specific tools and technologies relevant to regulatory requirements.
Subdomain Discovery: Utilizes Certificate Transparency logs to identify additional domains that may be subject to regulatory scrutiny.

Inputs Required:

domain (string): The primary domain to analyze (e.g., acme.com)
company_name (string): The company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial for organizations aiming to maintain compliance with legal and regulatory standards, particularly in sectors like finance, healthcare, and technology where strict data handling and disclosure practices are mandated. Compliance failures can lead to significant penalties, reputational damage, and operational disruptions.

Risk Levels:

Critical: Conditions that directly impact critical systems or pose a direct threat to organizational security, such as unaddressed data breaches or high-risk regulatory non-compliance.
High: Conditions that significantly increase the risk of potential compliance issues, including exposure in areas not previously identified but indicative of broader risks.
Medium: Conditions that indicate moderate risk and may require further investigation or remediation to align with regulatory standards.
Low: Informative findings that do not pose immediate risk but could be indicators for future strategic improvements in compliance practices.

Example Findings:

“We were notified of a security incident on our platform, indicating potential unauthorized access.”
“Our investigation revealed unauthorized access to sensitive data, which is indicative of regulatory non-compliance.”

Regulatory Findings Publication

Purpose: The Regulatory Findings Publication Scanner is designed to uncover hidden vulnerabilities and compliance gaps by analyzing public records and open-source intelligence (OSINT) sources. It aims to detect breaches of data, unaddressed security incidents, and inadequate risk factor disclosures within company documents such as SEC filings.

What It Detects:

Breach Mentions: Identifies mentions of data breaches, unauthorized access, compromised systems, and other related terms in public records and online sources.
Technology Stack Disclosure: Detects the technology stacks disclosed by companies, including cloud services like AWS, Azure, GCP, containerization technologies like Docker, and infrastructure automation tools like Terraform and Ansible.
Certification Claims: Identifies claims of various certifications such as SOC 2, ISO 27001, PCI DSS, and HIPAA compliance in public documents.
Security Advisories and Vulnerabilities: Detects mentions of security advisories, vulnerabilities, patches, and exploits that may affect the company’s systems or services.
Risk Factor Disclosures: Uncovers risk factors disclosed in SEC EDGAR filings that could impact the organization’s security posture and compliance requirements.

Inputs Required:

domain (string): The primary domain of the entity being analyzed, which helps in searching for relevant public records and disclosures.
company_name (string): The name of the company to focus on during research and analysis, aiding in the search for specific mentions related to this entity.

Business Impact: This scanner is crucial as it aids in proactive security practices by identifying potential breaches early, ensuring compliance with regulatory standards, and mitigating risks associated with compromised systems or unauthorized access to sensitive data.

Risk Levels:

Critical: Conditions that directly lead to severe impacts such as significant data loss, non-compliance with critical regulations, and high exposure to cyber threats are considered critical.
High: Issues that pose a high risk of security breaches, compliance violations, or substantial financial losses should be addressed promptly.
Medium: These risks require attention but may not have immediate catastrophic effects. They include vulnerabilities that could lead to data theft or system unavailability if exploited.
Low: Informational findings that are generally safe and do not pose significant risk unless amplified by other factors, such as minor compliance gaps that can be addressed through routine updates.
Info: These are non-critical issues that provide minimal risk but may indicate areas for improvement or further investigation in the security and compliance strategies of an organization.

Example Findings:

“The company has not disclosed any data breaches, which is a critical finding as it indicates a lack of transparency and potential exposure to risks.”
“The technology stack includes AWS and Azure, but there are no disclosures about proficiency in Kubernetes or Docker, indicating gaps in infrastructure modernization efforts.”
“The organization claims ISO 27001 compliance, but recent news articles suggest doubts about their adherence to this standard due to several unaddressed security incidents mentioned in the public records.”