Every organisation leaks more to the public internet than it realises: forgotten hosts, expired certificates, credentials in old breach dumps, a staging environment nobody switched off. Boty finds that exposure the way an adversary would, tests whether it can actually be used, and keeps watching after the report is delivered.
Infrastructure accumulates. A marketing site goes up for a campaign and stays up. A developer registers a subdomain for a test and moves on. A supplier gets access to a system and keeps it after the contract ends. An employee reuses a work address on a service that is later breached.
None of this is negligence — it is what happens to any organisation that operates for a few years. The problem is asymmetry: an attacker only has to enumerate your public footprint once, and the tooling to do that is cheap, fast and widely available. Most organisations have never done the same exercise against themselves.
The same sequence an adversary follows, run against you deliberately, with a report at the end instead of an incident.
You tell us which domains, brands and ranges belong to you. It goes in writing, including what is explicitly off limits.
We rebuild your public footprint from open sources — DNS, certificate transparency, registries, breach data, public code. Nothing touches your infrastructure.
Authorised, rate-limited checks establish which assets are live, what they run, and which findings are real rather than artefacts of the data.
Each finding gets a severity, a realistic attack path and evidence — so the list can be worked top to bottom instead of argued about.
Optional: the same discovery runs on a schedule, so you hear about a new exposure when it appears rather than at the next assessment.
Security work and engineering work, from the same base: extracting reliable signal out of large volumes of messy real-world data.
Everything about your organisation that is reachable from the public internet, enumerated and ranked.
Adversary simulation against web applications, APIs, infrastructure and cloud — with proof rather than guesswork.
A weekly written brief on the advisories, campaigns and regulatory changes that touch your stack and your sector.
Text, Image and video processing systems assessed or integrated to run in production, not to demo well.
These are the finding types that recur across almost every external assessment. Each one is discoverable from outside your network, usually without touching a single one of your systems.
Read how the analysis is scopedA security vendor that will not say what it does not do is asking you to take quite a lot on faith. So, explicitly:
Published when there is something worth publishing, not on a content schedule.
Why Boty publishes its methods instead of protecting them: the case against secret sauce in security, and what we are actually selling if not mystery.
ReadOpen-source intelligence from first principles: the sources analysts really use, how fragments get correlated, and how to run it against yourself.
ReadBoty is a Swiss security research lab. The work splits into three parts: mapping what your organisation exposes to the public internet, simulating how an adversary would attack it, and tracking security advisories continuously so you find out about relevant exposure early. A fourth strand, applied computer vision, comes from the same engineering base.
Small and mid-sized organisations that depend on internet-facing systems but do not have a dedicated security team. If nobody in your company can produce a complete list of your public-facing assets from memory, that is the gap we close.
No. Discovery uses public sources only and never touches your infrastructure. Anything that does touch your systems is authorised in writing beforehand, scoped to named assets, and stops when you say stop.
A vulnerability scan checks hosts you already know about. An attack surface analysis starts from the outside with no inventory and reconstructs one — which is why it usually finds assets your own documentation does not list.
Send a short description of your environment. You get back a scoped proposal — what would be examined, how long it takes, and what it costs. No obligation and no sales sequence.