Contextual intelligence for risks beyond the perimeter.
Vigil correlates credential exposure, underground activity, phishing infrastructure and externally observable technology risk with the domains, identities, brands and third parties relevant to your organisation. Deploy it as an on-premises appliance or use it as a managed SaaS service.
Seven intelligence modules. One correlation engine.
Each module addresses a distinct external-risk domain while using a shared correlation, investigation and reporting workflow.
Credential Intelligence
Stealer logs, combolists and breach dumps matched to authorised identities, with exposure relationships and a timeline.
ExploreDark Web & Underground
Selected forums, marketplaces, lawfully accessible messaging communities and ransomware leak sites monitored for relevant organisational references.
ExplorePhishing & Brand
Look-alike domains, phishing infrastructure and fake pages — with evidence to support investigation and abuse reporting.
ExploreExternal Risk Assessment
Structured checks across authorised domains, with evidence-backed findings, relevant MITRE ATT&CK references and prioritised remediation guidance.
ExploreSupply Chain & VIP
Vendor breach records, ransomware victim lists, mentions of your suppliers in monitored underground sources and executive exposure provide current evidence for third-party review.
ExploreVulnerability Intelligence & Response Workflows
Vulnerability records with KEV context are matched to observed technologies; supported workflows route findings to SIEM, SOAR, Jira or Teams.
ExploreMalware & Payment Security
Suspicious files are read and checked against YARA rules on your instance, never executed or retained; merchant, terminal and BIN identifiers are watched across monitored sources.
ExploreFrom external signal to prioritised security action.
A unified workspace for monitoring, investigation, evidence review and reporting. Analyst-level evidence and executive-level reporting are produced from the same underlying findings.
Not a leak list. A clear picture, person by person.
Vigil groups everything it finds for your domain by person and orders it newest first: the infected device, the saved logins taken from it, the company systems among them, the passwords held and what to do next. Each profile can be issued as a filed PDF report with an acknowledgement form.
One card per person: infected device detected or not, company systems reached, plaintext passwords, latest activity.
A report you can hand over and keep on file.
One click turns a profile into an A4 PDF in Turkish or English. It carries a report number, a SHA-256 document digest and a user acknowledgement form with signature fields, so the notice to the employee is on record.
Click a page to enlarge
Illustrative screens with sample data — no customer data is shown. "ornek-holding.example" is a reserved example name.
Findings you can act on, with the evidence attached.
A record is useful when it tells you what changed, where it came from and who needs to be informed. Vigil carries that context with each finding.
New-password detection
When a login already on record appears with a password not seen before, Vigil raises it as a new exposure rather than a repeat. Reposted dumps and the same password in another list are recognised and kept out of the alert stream.
Source and seller attribution
Each infected-device record keeps the channel that published it and, where the log names one, the seller that distributed it — so a fresh sale can be told apart from an old archive in recirculation.
Domain exposure report
One PDF for the whole domain: people at risk, infected devices, captured logins to your own systems, breach sources and recommended actions. Turkish or English, passwords masked by default, with a report number, a SHA-256 digest and an acknowledgement form.
A structured assessment of externally observable risk.
Vigil evaluates a customer-authorised domain through phased discovery and intelligence checks. Results are normalised, correlated and prioritised to support technical remediation and management reporting.
- 01DiscoverAssets and attack surface
- 02CorrelateLeak, brand and threat data
- 03PrioritiseCVE, MITRE ATT&CK, attack paths
- 04ActRisk score, plan and report
Alerts, response and reporting on the same platform.
A finding is not the end of the work. Vigil carries it through notification, takedown, prioritisation and the report your management or auditor will read.
Alerts you configure
For each category you set whether it notifies, the minimum severity and the e-mail preference. Critical and high findings appear in the in-product alert stream; the monitor checks new records every 30 seconds.
Response and takedown
Takedown Center keeps the case, the notice, the reply and the evidence in one process. Notices are sent from your own SMTP server; a notice counts as sent only when the mail server accepts it. Removal remains the provider’s decision.
Reports for each audience
Executive, technical, compliance, VIP, vendor and brand reports are produced as PDF in Turkish and English. Delivery by download, e-mail or schedule; each report fixes its period so the next one can be compared against it.
Supply-chain monitoring
Add a supplier by name and domain. The monitor compares against the previous state every 30 minutes and routes new changes and new exposure to the related alert category.
Vulnerability prioritisation
A vulnerability is assessed by its technical score together with exploitation likelihood, active exploitation in the CISA catalogue and whether a public exploit exists. Records that name a monitored supplier enter the alert stream.
Threat graph and regional context
The threat graph links credentials, leaks, actors, domains, IOCs and campaigns so a finding can be followed to its relationships. Regional modules follow national sources and the groups active in each region.
A deployment model designed for operational control.
In an on-premises deployment, curated intelligence is synchronised to the customer appliance through a documented channel. Matching against monitored assets and identities occurs within the customer-controlled environment.
Access to Vigil is protected as carefully as the data in it.
Vigil holds sensitive findings about your people and systems. Accounts, sign-in, updates and support are designed so that only the right people see them and every administrative action leaves a trace.
Enforced two-step sign-in
Panel accounts sign in with a password and an authenticator code. One-time recovery codes cover a lost phone, and repeated failures pause the account.
Invitation-based accounts
Administrators invite colleagues instead of choosing passwords for them. A single-use link lets each person set their own password and authenticator; no one else ever knows it.
Single sign-on
Connect an OpenID Connect identity provider such as Microsoft Entra ID or Okta, restrict sign-in to your e-mail domains and, if you choose, make SSO the only way in.
Immediate access removal
Deactivating a user, resetting their access or setting a new password ends their open sessions at once, not when a token would have expired.
Audit trail and scope
Administrative actions are recorded with who, when and from where. Searches and exports are limited to your verified domains.
Updates and support
On-premises appliances install verified releases in a night window you control and restore the previous version automatically if a post-install check fails. Support cases are opened from the panel, and replies arrive there.
GNSAC’s information security management system is certified to ISO/IEC 27001:2022 (certificate no. MTS-52898, issued by Invicta Assurance International, IAS-accredited). The scope covers the design, development, delivery, operation and support of our cyber threat intelligence platforms, dark web monitoring, external attack surface management, brand protection and phishing simulation services.
Integrate external intelligence into existing security operations.
Deliver validated findings and alerts to SIEM, SOAR, case-management and collaboration platforms through supported connectors, webhooks and REST APIs. Vigil complements existing SOC processes without requiring analysts to replace their primary operational tools.
Product overview and review materials.
Vigil brochure
Reviewed product overview for security, risk and procurement teams — PDF.
OpenArchitecture and data-flow review
Deployment, connectivity, data location, access control and retention are reviewed against the customer environment.
OpenIntegration and API scope
Supported integrations and API functions are confirmed for the selected licence and order form.
OpenQuestions buyers ask before a demo.
What sources does Vigil monitor?+
Vigil monitors selected underground forums and marketplaces, lawfully accessible messaging communities, stealer log collections, breach datasets, paste services, exposed code repositories, phishing and certificate-transparency sources, ransomware leak sites and vulnerability intelligence. Coverage changes as sources become available, relevant or inaccessible.
How fast are we alerted?+
Collection and matching are continuous. Depending on source availability and processing status, high-priority alerts can be generated within minutes of ingestion and routed according to customer-defined rules.
Does Vigil replace our SOC?+
No. Vigil is the external intelligence and exposure layer. Your SOC continues to monitor internal telemetry; Vigil routes relevant externally observed findings into the tools your SOC already uses.
Where is customer data stored?+
For on-premises deployments, monitored assets, findings and user activity are stored in a customer-isolated database within the customer-controlled environment. Connectivity and data-flow requirements are documented during security review. SaaS data-location and retention requirements are agreed during scoping.
How long does deployment take?+
A standard on-premises implementation is generally completed within four weeks, subject to infrastructure readiness, security approvals and integration scope.
How is it licensed?+
Vigil is licensed per organisation in three tiers. Monitored scope, users, scans, reports, deployment model and Enterprise limits are confirmed in the applicable quote and order form.
What is the personal exposure report, and can it be handed to the employee?+
Vigil groups the records found for your domain by person: infected-device captures, stolen logins, the company systems among them and the passwords held. Each profile can be issued as a PDF in Turkish or English with a report number, a SHA-256 document digest and a user acknowledgement form with signature fields, so the notice to the employee can be kept on record. Passwords are masked by default.
How do you keep false alarms down?+
A record is raised only when it is new to you. Old dumps that are reposted, known compilations and the same password resurfacing in another list are recognised and kept out of the alert stream; they remain visible in the record history.
How is access to the panel protected?+
Every panel account signs in with a password and an authenticator code, and accounts are created by invitation so that each person sets their own password. Single sign-on through an OpenID Connect provider is supported, administrative actions are recorded in an audit trail, and removing a user ends their sessions immediately.
How does an on-premises appliance stay up to date?+
The appliance checks for new releases and installs them in a night window you choose; automatic updates can be switched off. Each release is verified before installation, and the previous version is restored automatically if the post-install check fails.
How do we reach support?+
Open a case from the licence page in the panel. It reaches the GNSAC support team with your company and instance details, and replies appear in the panel. You can also write to [email protected].
How does Vigil handle personal data under KVKK?+
Personal data is processed solely to remediate an information security risk to your organisation. In an on-premises deployment, findings and user activity stay in the customer-controlled environment. The terms of processing are set out in the agreement.
Can we run an evaluation (POC) first?+
Yes. The scope, duration and conditions of an evaluation are agreed with GNSAC according to your environment and the use cases you want to test.
Evaluate Vigil against your external risk profile.
Review the platform, an anonymised assessment report and the deployment model with GNSAC.