SecurityScorecard Buys Driftnet for More Internet Visibility

SecurityScorecard purchased an internet scanning startup led by a longtime United Kingdom government researcher to get deeper visibility into internet infrastructure and hidden exposures.

See Also: Autonomous Security in the AI Era: Efficiency Meets Efficacy

The New York-based third-party risk management vendor said Driftnet was engineered to discover hidden infrastructure through highly targeted reconnaissance techniques that map relationships between configurations and identify chained misconfigurations, said co-founder and CEO Aleksandr Yampolskiy. Driftnet indexes about 40% more internet-exposed hosts than rival platforms, he said.

“Artificial intelligence has changed the attack surface in ways that have outpaced most security programs,” Yampolskiy told ISMG. “Agents are deployed across vendor environments at scale and speed that really creates entirely new categories of third-party risk.”

Driftnet, founded in 2019, employs fewer than 10 people and hasn’t disclosed any outside funding. The company has been led since inception by Ben Schofield, who previously spent more than 12 years as a U.K. government researcher, seven of which were focused on the architecture and implementation of large-scale cyber systems (see: SecurityScorecard Buys HyperComply to Expand Risk Platform).

Why SecurityScorecard Chose to Buy Driftnet Rather Than Partner

Yampolskiy said Driftnet dynamically maps both IPv4 and IPv6 environments and monitors more than 3 billion IP host-port combinations as well as more than 650 million domain names. Using Driftnet’s reconnaissance data, Yampolskiy said SecurityScorecard researchers were able to identify publicly accessible OpenClaw control panels in real time.

“We were able to use Driftnet technology and Driftnet data to get a live view of all the OpenClaw instances out there, because a lot of people deploy these OpenClaw assistants, but then they don’t secure them properly,” Yampolskiy said. “And so using this live real-time reconnaissance data, we were able to instantly discover all the publicly accessible OpenClaw control panels.”

SecurityScorecard also grappled with a Chinese espionage campaign involving more than 1,000 infected operational relay boxes targeting U.S. infrastructure through compromised small office routers and edge devices. He said Driftnet’s visibility helped researchers identify malicious infrastructure attack patterns and uncover activity that SecurityScorecard previously would not have been able to detect.

“We weren’t able to discover this type of data before, but now we can, so as a result, we’re able to make much faster, smarter business decisions,” Yampolskiy said.

Owning Driftnet allows SecurityScorecard to directly control data quality, attribution accuracy and future innovation, Yampolskiy said. Rather than licensing data externally, Yampolskiy said the company can now customize and expand the intelligence platform internally to support evolving use cases tied to AI security, threat hunting and internet-scale visibility.

“SecurityScorecard’s differentiator has always been that we chose to collect all of our data ourselves because we want to own the accuracy of the data,” Yampolskiy said. “We want to own the attribution of the data. So basically, the threat landscape changed faster than many programs have, and now that we have this data, we can basically evolve with a change in the landscape.”

How Driftnet Unites Third-Party Risk, Security Operations

Driftnet’s capabilities extend beyond compliance-oriented third-party risk management programs and into core security operations workflows by giving organizations real-time operational visibility into internet infrastructure, exposed assets and active targeting activity, Yampolskiy said. The platform can feed intelligence directly into security operations centers, enabling organizations to detect risks faster.

“Driftnet allows you to gain real-time visibility into your OT, IoT environments to protect operational resilience, to discover your cloud footprint assets, to measure shadow AI and protectively defend against threats,” Yampolskiy said. “So, we basically become the bridge between the compliance-focused TPRM teams and the actual threat-focused SOC teams.”

SecurityScorecard plans to integrate Driftnet tightly into its Titan platform while also continuing to sell it as a separate product. Customers in industries such as financial services want to consume the intelligence directly through APIs and integrate the data into their own SOC environments, SIEMs and threat intel platforms. SecurityScorecard also wants Driftnet to improve visibility across all customer workflows.

“People love it as a standalone product, because they can put it into their SOC immediately,” Yampolskiy said. “But we’re not in the business of having 10 standalone products. It’s a separate SKU that you can purchase separately, but it’s all part of the SecurityScorecard Titan platform to make sure that all these pieces benefit from being part of this platform.”

Driftnet’s capabilities are particularly attractive to large enterprises, financial institutions and public sector organizations since they have dedicated threat hunting teams capable of operationalizing large-scale threat intelligence and internet reconnaissance data. Smaller organizations often outsource their SOC functions and may lack the internal resources necessary to fully leverage this type of intelligence.

“Those Tier Is can do more with the Driftnet data,” Yampolskiy said. “They can better hunt the threats. They can better detect the threats, they can protect the environment. So all of a sudden, they see what the hacker sees. Effectively, they’re able to see the unique 0.1% of what the hackers see and sell on the dark web, and they’re able to see that infrastructure that could be malicious.”