The Hacker's Hackers · PenTesting · Ethical Hacking · Red Teaming
Real Enterprise Security. Built for Your Business.
We think like real adversaries so you don't have to meet one. PhishRoot pairs Penetration Testing, Ethical Hacking and Red Teaming with continuous attack-surface monitoring and the 24/7/365 PhishRoot SOC.
Authorized scope first · Free passive scan · Free plan included
Sample findings, demo data
Built for lean security teams
Exposure management without the enterprise price tag or the agent rollout.
Passive analysis
Findings come from public signals and read-only imports — nothing is probed or exploited.
No agents
First findings without installing anything on a server or device.
Private workspaces
Every customer's findings stay inside their own organization.
Free to start
Scan a domain and save up to 10 findings on the free plan.
PhishRoot in plain English
One security guard. One clipboard.
Most companies check ten different tools to know if they are safe. PhishRoot looks at your accounts, laptops, cloud and code for you, and puts every open door on one simple list, most urgent first.
Yuna Kim · Security Researcher
A one-minute tour of PhishRoot
Transcript
[Yuna, AI-generated presenter audio, 92% speed] Hi, I'm Yuna Kim. Welcome to PhishRoot, the security platform built for MSPs and MSSPs. [Off-camera narration, synthetic TTS voice, different from presenter] Here's the PhishRoot homepage. Findings in this animation are illustrative examples. One review for identities, devices, cloud, and code. Risk Radar checks public domain signals passively. Scans need a free account. Identity, Endpoint, and Cloud review imported snapshots. Demo results aren't saved. Secrets checks code locally. Respond tracks imported incidents. Continuous testing starts with domain verification and stays passive. [Yuna, AI-generated presenter audio, 92% speed] PhishRoot helps your team review risks and track fixes. Please watch our other video series.
- 1
Spot
It connects to the apps you already use and spots open doors, like a forgotten password or a public file.
- 2
Prioritize
It tells you what is an emergency today and what can wait until next week.
- 3
Close
It gives you a one-click fix, or pings the right teammate, before an attacker notices.
Findings workflow · illustrative example
Found at 09:41.
Closed at 09:45.
PhishRoot does not hand you a list to work through. Each finding arrives with an owner, a plain-language fix and a status you can track until it is closed.
- Assign each finding to a teammate
- Rescan to confirm a fix actually closed it
- Export findings and history for audits
Times shown are an example, not measured customer results
- 09:41
Stale admin account
Left the company 212 days ago and is still a global admin
Identity · High
open
- 09:38
Secret in a build log
A database password printed by a CI job
Secret · Critical
open
- 09:35
Forwarding rule to a personal inbox
Finance mail copied outside the company
Identity · High
open
- 09:32
Expired TLS certificate
The partner API certificate lapsed last night
Network · Medium
open
- 09:29
Unused service account
Owner role on the billing project, idle for 96 days
Identity · High
open
- 09:26
Public S3 bucket
Customer exports readable without a login
Cloud · Critical
open
- 09:23
Phone · no screen lock
Reads company mail without a passcode
Endpoint · Low
open
Sample findings, demo data
Coverage
Four surfaces.
One watch.
Every employee, contractor and service account, with what each can reach and when it was last used.
- Stale accounts
- MFA gaps
- Shared passwords
- Admin sprawl
Identity · High
Stale admin account
Identity · Medium
Shared admin password
Identity · High
Contractor · MFA off
Products
Five products, one list of what is exposed.
Start with the surface that worries you most. Every product writes into the same findings list, so nothing has to be stitched together later.
1IdentitiesOpenIdentity
Review account access and authentication gaps.
- Input
- CSV / JSON snapshots
- Checks
- MFA, inactive accounts, admin access
- Remediation
- Assigned, tracked and reviewed
2DevicesOpenEndpoint
Review devices that have fallen behind.
- Input
- CSV / JSON device inventory
- Checks
- Encryption, locks, patches, protection
- Evidence
- Imported device settings
- CloudOpen
Cloud
Review public resources and cloud settings.
- Input
- CSV / JSON resource inventory
- Live tool
- Public domain scanner
- Checks
- Exposure, encryption, logging, permissions
- Code & secretsOpen
Secrets
Find potential keys and tokens in code.
- Input
- Pasted code or source files
- Detectors
- 8 credential pattern families
- Privacy
- Raw credentials are never uploaded
- Detection & responseOpen
Respond
Track incidents from first signal to closed.
- Input
- CSV / JSON incident records
- Workflow
- Assign, investigate, resolve
- Evidence
- Organization activity log
Live operations · demonstration console
phishroot / night shift · booting analyst · v4.12
- 1.ingest.cloudok
- 2.ingest.identityok
- 3.ingest.endpointok
- 4.analystawake
--:--:-- UTC
- ● user
- ▣ service
- ▬ laptop
- ◇ bucket
Events read today
2,327,763
33/s · 99.7% closed without waking anyone
Threat · triaging
impossible travel · j.doe
Toronto → Singapore in 13 min
pulling related events across idp, endpoint, cloud…
Incident replay · demonstration
03:12 UTC. Nobody's awake. That's fine.
A fictional night, replayed the way Respond records a real one: every event read, every action logged, attributed and reversible. Names invented, timings illustrative.
$ phishroot replay INC-1042 --from 03:12:00Z
Press Replay — takes about fifteen seconds.
$
Capabilities · live-feel demos
Everything a SOC does at 3 a.m. Minus the SOC.
Five jobs that usually need a room full of people and a lot of coffee. Each tile below is running on demonstration data, like the product.
Identitylogins · demo
Every login, everywhere
Learns where and how each person signs in, then notices when physics gets involved.
- s.virtaHelsinki · ok
- w.zhouSan Francisco · ok
- o.brennanNew York · ok
Endpointfleet · demo
Laptops check in from lounges, too
Fleet health at a glance — patched, behind, or asleep at 3 a.m.
0.0%
0 of 1,204 behind on patches · 17 asleep
Cloudapi calls · demo
Audit logs, read in full
Not sampled. Every call, every region, every bucket that answers to the internet.
4,164 / min
audit calls read in full · 3 regions
Secretsrotation · demo
Tokens that rotate themselves
A leaked key expires before anyone finishes pasting it.
tok_ci_deploy ·•••••••7f3a
rotated 4 s ago · next in 6 h
Respondcontrol · demo
Nothing happens without a yes
The analyst proposes, a human disposes. Every action reversible for 24 hours.
PhishRoot · INC-1042 · now
Revoke 4 sessions for j.doe?
One incident, two endings
The same leaked key. Two very different endings.
A cloud key is pushed to a public repository on a Tuesday afternoon. What happens next depends on whether anyone is watching.
0
Days before anyone noticed
Without PhishRoot
Found on day 212Day 0
Key pushed to a public repo
A deploy script with a live cloud key lands in a public repository.
Day 3
Copied by a scraper
Automated scanners pick the key up. Nobody is told.
Day 41
First quiet login
The key is used from a new country to list storage buckets.
Day 130
Customer records copied
1.2 million rows leave over nine nights.
Day 212
Found by a customer
A customer reports their data for sale. The clock starts now.
With PhishRoot
✓ Closed in 4 min0:00
Key pushed to a public repo
0:40
Finding opened
1:30
Owner paged
3:10
Key revoked
4:00
Closed
Illustrative scenario, not a customer result
Integrations
Connects to what you already run.
Read-only access, no agents to roll out for the first findings. Most teams connect their identity provider and one cloud account in the first hour.
0 / 12 connected · Read-only by default · no credentials stored
In numbers
What gets measured gets closed.
What the platform does today. Your own numbers sit on the first screen of the product.
Time to first scan
< 1 min
Enter a domain and see its public exposure grade in seconds.
Products
5
Identity, Endpoint, Cloud, Secrets and Respond in one workspace.
Free plan
10 findings
Save and track real findings before you ever pay.
Monitoring
Daily
Paid plans re-check your assets every day and email what changed.
Scenarios
What a first week can look like.
Four illustrative scenarios built from common exposures. They show the workflow — they are not customer results.
Closed
340
orphaned accounts to close in week one
How PhishRoot is sold
Buy direct. Or through your MSP.
PhishRoot sells direct and through MSP and MSSP partners — choose whichever fits your business. Work with us directly, or keep the partner that already looks after you as your single point of contact, with the PhishRoot SOC behind them. We never undercut a partner.
Team
Self-managed: you see the risks and fix them.
- Self-managed platform
- Identity and Endpoint
- Daily sweep
- Slack and email alerts
- 90 days of history
- Community support
Business
Most chosenSelf-managed with SOC backup: your team runs day to day and escalates incidents to the PhishRoot SOC.
- Everything in Team
- Cloud and Secrets
- Continuous sweep
- Network checks and incident and ticket queue
- PhishRoot SOC: investigation of incidents you escalate
- Jira and PagerDuty
- Evidence exports for audits
- 13 months of history
Enterprise
Co-managed: the PhishRoot SOC works alongside your team around the clock.
- Everything in Business
- PhishRoot SOC: 24/7/365 "Follow The Sun" proactive monitoring, investigation and agreed response
- Respond with custom playbooksplanned
- Single sign-on and SCIMplanned
- Private data regionplanned
- Named engineer and 1-hour responseplanned
Proposed PenTest starting prices appear on Pricing. Buy direct from PhishRoot, or contact us to work through your MSP or MSSP. Items marked planned are on our roadmap and not available today. Custom playbooks and named-engineer support are not currently offered; no 1-hour response is guaranteed. Business SOC coverage covers investigation and remediation guidance for incidents your team escalates; it does not include proactive monitoring, and your team applies the fixes. Enterprise adds 24/7/365 proactive monitoring and agreed response. Response targets are agreed in the service agreement.
What we build toward
The first sweep should pay for the year.
The outcomes every PhishRoot feature is designed to deliver.
Goal 01
“Find the global admin who left seven months ago — before an attacker does.”
Questions
Asked before every rollout.
What security and IT teams want to know before they connect the first source.
Connect your identity provider and most teams see their first findings in under an hour. Cloud accounts and device managers each add a few minutes. Nothing is installed on a server to get started.
Start here
Scan your domain.
Risk Radar reads only public signals: DNS records, email policies and your site's HTTPS response. Create a free account to run the scan and save up to 10 findings.
Risk Radar checks
- SPF and DMARC email spoofing protectionPassive
- Mail servers and certificate authority recordsPassive
- HTTPS and certificatePassive
- Security headersPassive