See what attackers can see. Know what matters.
Managed External Attack Surface Management and Digital Risk Protection
RADAR+ is CypherLeap’s analyst-managed EASM and DRP service. It continuously maps your internet-facing footprint, watches the surface, deep and dark web for threats to your brand and credentials, and reports only what a CypherLeap analyst has validated, the same day it is confirmed.
Your external attack surface is larger than your asset register.
Every cloud service, subdomain, certificate, SaaS tool and forgotten test environment is visible from the internet. So is every credential your staff have reused on a breached site, and every domain registered to look like yours. Your internal tools were built to defend the network. None of this is inside it.
Unknown assets
Subdomains and cloud instances nobody remembers provisioning, still reachable and still yours.
Vulnerable software
Internet-facing services running versions with known, exploitable vulnerabilities.
Exposed data
Open storage, leaked documents and source code in public repositories.
Certificate and DNS failures
Expired certificates and stale records that erode trust and invite interception.
Leaked credentials
Staff logins traded in criminal marketplaces and stealer logs.
Brand impersonation
Look-alike domains, cloned apps and fake social accounts built to deceive your customers and staff.
Phishing infrastructure
Cloned login pages and rogue hosts staged before a campaign launches.
Third-party exposure
Vendor and supply-chain services carrying your data outside your control.
What is RADAR+? Managed EASM and DRP in one service.
Two disciplines, one analyst-managed service. EASM watches what you own. DRP watches what others are doing with your name and your data.
What is External Attack Surface Management?
External Attack Surface Management (EASM) is the continuous discovery, inventory and monitoring of an organisation’s internet-facing assets as an attacker would see them: domains, subdomains, IP addresses, cloud services, certificates, open services and software versions.
EASM finds the assets and exposures an organisation does not know it has. Internal vulnerability scanning covers what is already on the asset register; EASM covers everything else.
What is Digital Risk Protection?
Digital Risk Protection (DRP) monitors the surface, deep and dark web for threats that target an organisation from outside its own infrastructure: leaked credentials, brand and executive impersonation, look-alike domains, phishing infrastructure and data offered for sale on criminal marketplaces.
DRP includes dark web monitoring and, where infrastructure is confirmed as malicious, coordination of its takedown.
RADAR+ is a managed External Attack Surface Management and Digital Risk Protection service delivered by CypherLeap, an Australian cybersecurity consultancy and managed security services provider. It is built on the SOCRadar Extended Threat Intelligence platform, which CypherLeap licenses, operates and configures on the customer’s behalf. Every alert the platform generates is validated by a CypherLeap analyst before it is reported.RADAR+ is one of six CypherLeap disciplines, alongside Virtual CISO, Managed GRC, Managed SIEM, Penetration Testing and Managed IT & Cyber Support.
How RADAR+ works: discover, monitor, validate, prioritise, act, report.
The platform discovers and monitors. CypherLeap analysts decide what is real and what matters. Your team acts on validated findings and owns remediation. Same cycle, every day, at every tier.
Discover
Continuous mapping of every internet-facing asset, measured against your root domains and known business infrastructure.
PlatformMonitor
Surface, deep, and dark web monitoring runs around the clock for your brand, identifiers, and credentials
PlatformValidate
A CypherLeap analyst triages every alert. False positives and low-value noise are removed, not forwarded.
CypherLeap analystPrioritise
Confirmed findings are risk-scored against your actual footprint and business context for clear response prioritisation.
CypherLeap analystAct
Same-day notification and takedown coordination for confirmed malicious infrastructure within your allowance.
CypherLeap and youReport
Monthly service report and scheduled review meetings with your engagement contact to discuss key findings.
CypherLeap and youWhat does RADAR+ monitor?
Seven categories, watched continuously. Every tier runs the same modules: EASM plus Digital Risk Protection, including dark web monitoring. Tiers differ only in how much of your footprint is covered.
External attack surface monitoring
Internet-facing assets, open services, software versions and cloud instances discovered against your domains.
Domain and typosquatting monitoring
Look-alike registrations, DNS changes, certificate expiry and subdomain sprawl.
Credential exposure monitoring
Leaked and traded staff logins from breach dumps, stealer logs and criminal marketplaces.
Brand impersonation monitoring
Brand, product and executive names searched across the open, deep and dark web for targeting and abuse.
Phishing detection and takedown
Cloned pages and rogue hosts identified, validated and taken down within your tier’s allowance.
Digital property monitoring
Social media accounts, mobile apps, IP ranges, VIP accounts and third-party staff accounts.
Dark web monitoring
Forums, marketplaces, paste sites, Telegram channels and leaked databases.
Supply chain and vendor monitoring
Third-party exposure for 10, 25 or 50 nominated vendors. Available as an add-on to any tier.
Why use a managed EASM service instead of buying a platform?
An EASM or DRP platform produces alerts. Someone still has to validate each one, remove the false positives, decide what is real, work out what it means for your organisation and act on it. If you buy the platform, that someone is your team. With RADAR+, it is a CypherLeap analyst, and what reaches you is a validated, risk-scored finding, not a queue.
We are open about the technology: RADAR+ runs on SOCRadar, a platform you can evaluate for yourself. What you are buying from CypherLeap is the analyst layer, the fixed-scope commercial model, the included takedowns and a monthly review with someone accountable for the outcome.
| Consideration | EASM / DRP platform only | Platform plus your internal team | RADAR+ by CypherLeap |
|---|---|---|---|
| Who triages alerts | Nobody. Alerts accumulate in a dashboard. | Your analysts, in the time they have. | CypherLeap analysts, every alert, every tier. |
| False positives | Delivered as raw output. | Filtered by your team, at your cost. | Removed before they reach you. |
| Prioritisation | Platform scoring only. | Your team's judgement, if capacity allows. | Risk-scored against your footprint by an analyst. |
| Takedowns | Usually a separate service or per-incident fee. | Your team coordinates with registrars and hosts. | Coordinated by CypherLeap, allowance included in every tier. |
| Reporting | Dashboard access. | Built and maintained by your team. | Monthly service report and review meeting, every customer. |
| Scope and cost | Asset-count licensing, often opaque. | Licence plus headcount. | Three published tiers with fixed allowances; scope increases without re-onboarding. |
| Accountability | Vendor support desk. | Internal. | A named CypherLeap engagement contact. |
Validated, not forwarded. That is the difference between a monitoring platform and a managed service.
What you receive from RADAR+.
Identical at every tier. Coverage scales with your footprint; the standard of service does not change.
Exposures found before they are exploited
Continuous discovery of unknown assets, vulnerable services, expired certificates and exposed data across your external footprint.
Only validated findings reach your team
Every alert is reviewed by a CypherLeap analyst. Noise is removed, and your team's time goes to remediation rather than triage.
Same-day notification of confirmed threats
Validated, risk-scored findings are reported the day they are confirmed, with the context needed to act.
Impersonation taken down, not just reported
Confirmed phishing and impersonation infrastructure is taken down within your tier's included allowance, coordinated by CypherLeap.
A monthly view you can put in front of the board
A structured monthly report and a scheduled review meeting covering findings, trends and remediation status.
One accountable person
A named CypherLeap engagement contact responsible for your service, from onboarding through every monthly review.
Trusted by regulated Australian organisations.
CypherLeap works with healthcare, financial services, government and professional services organisations across Australia and APAC, where security is driven by regulatory pressure, audit scrutiny and operational risk.
“CypherLeap has been a highly professional and reliable cybersecurity partner. Their team combines strong technical expertise with practical, business-focused advice and has consistently delivered high-quality outcomes across multiple security initiatives.”
Onboarding lead
Guides you through onboarding, configures the platform for the agreed scope and hands over to steady-state monitoring.
Analyst
Reviews and triages every alert, validates findings against your actual footprint and escalates confirmed threats.
Takedown coordinator
Executes takedown requests for confirmed infrastructure and coordinates dark web credential removal where applicable.
RADAR+ coverage tiers: Sentinel, Marshal and Legion.
All three run the same modules and receive identical deliverables. They differ only in the size of the footprint monitored. Published allowances, no per-alert or per-asset surprises.
Focused coverage for a core domain and brand.
- Root domains 1
- Brand identifiers 5
- Digital properties 10
- Takedowns per year 1
- Platform seats 1
Broader coverage as your footprint grows.
- Root domains 3
- Brand identifiers 15
- Digital properties 20
- Takedowns per year 3
- Platform seats 3
Enterprise-scale coverage for complex environments. Larger footprints are scoped individually.
- Root domains 6
- Brand identifiers 30
- Digital properties 40
- Takedowns per year 6
- Platform seats 5
| Allowance | Sentinel | Marshal | Legion |
|---|---|---|---|
| Monitored assets (EASM) | 100 | 300 | 500 |
| Root domains (including dark web) | 1 | 3 | 6 |
| Brand identifiers | 5 | 15 | 30 |
| Digital properties | 10 | 20 | 40 |
| Takedowns included per year | 1 | 3 | 6 |
| Client platform seats | 1 | 3 | 5 |
| Deliverables are identical across all three tiers: same-day notification of validated findings, a monthly service report and a monthly review meeting. | |||
Add-ons can be attached to any tier: RADAR+ Tokens for additional takedown and credential-removal capacity, supply chain vendor monitoring (10, 25 or 50 vendors), an anti-phishing web trigger that flags cloned pages hosted on rogue infrastructure, delivery of RADAR+ intelligence into your SIEM or other tooling, and scope extensions for assets, domains, identifiers, properties and seats.
Getting started with RADAR+.
CypherLeap leads onboarding. Your input is limited to confirming scope, nominating contacts and validating ownership of discovered assets.
Initiate
Kick-off. Service owners, escalation contacts and report recipients confirmed.
Define scope
Root domains, brand identifiers, digital properties and any vendor list agreed.
Configure and discover
Platform configured, initial discovery run, seats provisioned. You confirm asset ownership.
Baseline and tune
Analyst review of discovery, out-of-scope assets removed, baseline findings issued.
Transition
Steady-state monitoring, escalation and reporting begin. First review scheduled.
What RADAR+ is not
RADAR+ is a detection, validation and reporting service. The following sit outside it at every tier and are available as separate CypherLeap engagements.
- Penetration testing
- Social engineering and phishing simulation
- Malware sandbox simulation
- Breach or incident simulation
- Digital forensics and incident response
- IOC enrichment and SIEM/SOAR integration (available as an add-on)
RADAR+ frequently asked questions.
What is RADAR+?
RADAR+ is CypherLeap’s analyst-managed External Attack Surface Management (EASM) and Digital Risk Protection (DRP) service. It continuously maps your internet-facing footprint and monitors the surface, deep and dark web for threats to your brand, your domains and your staff credentials.
Every alert the platform generates is triaged by a CypherLeap analyst before it reaches you. What you receive is a validated, risk-scored finding, not a queue of raw alerts.
What is the difference between EASM and Digital Risk Protection?
EASM watches what you own: domains, subdomains, IP addresses, cloud services, certificates, open services and software versions, discovered as an attacker would see them.
DRP watches what others are doing with your name and your data: leaked credentials, brand and executive impersonation, look-alike domains, phishing infrastructure and data offered for sale on criminal marketplaces.
RADAR+ runs both as a single managed service. Every tier includes both, including dark web monitoring.
Which platform does RADAR+ run on?
RADAR+ is built on the SOCRadar Extended Threat Intelligence platform, which CypherLeap licenses, operates and configures on your behalf.
We are open about the technology because the platform is not what you are buying. You are buying the analyst layer on top of it, the fixed-scope commercial model, the included takedowns and a monthly review with someone accountable for the outcome.
Is every alert reviewed by a person?
Yes, at every tier. A CypherLeap analyst triages each alert against your actual footprint, removes false positives and low-value noise, and risk-scores what remains against your business context.
Alerts that do not survive triage are not forwarded to you.
How quickly are confirmed exposures reported?
Validated findings are reported the same day they are confirmed, with the context your team needs to act.
Remediation remains with your team. RADAR+ is a detection, validation and reporting service, with takedown coordination for confirmed malicious infrastructure.
What is included in the takedown allowance?
Takedowns of confirmed phishing and impersonation infrastructure are coordinated by CypherLeap and included in every tier: one per year on Sentinel, three on Marshal and six on Legion.
Additional takedown and credential-removal capacity is available as an add-on through RADAR+ Tokens.
Which tier should we choose?
All three tiers run the same modules and produce identical deliverables. They differ only in the size of the footprint covered: 100 monitored assets on Sentinel, 300 on Marshal and 500 on Legion, with root domains, brand identifiers, digital properties, takedowns and platform seats scaling alongside.
A 30-minute scoping call is the fastest way to settle it. We walk through your external footprint as we already see it, confirm scope and recommend a tier. Footprints larger than Legion are scoped individually.
Can we increase scope during the term?
Yes. Assets, domains, identifiers, digital properties and platform seats can be added at any time without re-onboarding.
RADAR+ is a committed 12-month term with a fixed scope and fee, renewing annually unless notice is given. Your fee is set by scope, not by alert volume.
What does onboarding involve, and what do we have to do?
CypherLeap leads onboarding across five phases: initiate, define scope, configure and discover, baseline and tune, then transition to steady-state monitoring.
Your input is limited to confirming scope, nominating service owners, escalation contacts and report recipients, and validating ownership of the assets discovered.
What is not included in RADAR+?
Penetration testing, social engineering and phishing simulation, malware sandbox simulation, breach or incident simulation, and digital forensics and incident response all sit outside RADAR+ at every tier. Each is available as a separate CypherLeap engagement.
IOC enrichment and delivery of RADAR+ intelligence into your SIEM or SOAR is available as an add-on rather than as part of the base service.
What do we receive each month?
A structured monthly service report covering findings, trends and remediation status, and a scheduled review meeting with your named CypherLeap engagement contact.
Platform seats are included so your team can view findings directly: one seat on Sentinel, three on Marshal and five on Legion.
Discuss your external attack surface with CypherLeap.
A 30-minute scoping call with the people who will run your service. We confirm your root domains, brand identifiers and digital properties, recommend a tier and give you a fixed number. No sales theatre.
- Walk through your external footprint as we already see it.
- Confirm scope: domains, identifiers, properties, vendors.
- Match you to Sentinel, Marshal or Legion, plus any add-ons.
- Receive a Quotation and Service Order within two business days.
Not ready for a call? Check your organisation’s dark web exposure with the free report, or contact us.