Digital Risk Protection · agentic operation · for mid-market companies

What stays hidden, we find first.

Q: Do I need a security team to use it?

No. On Watch you follow everything yourself in the dashboard; on Detect the AI triages alerts for you; on Respond one of our specialists works alongside you. You choose how much to outsource.

Q: How long does it take to get started?

Four hours. You give us your domains and brands and the search starts. No multi-week project, no mandatory consulting.

Q: Does it connect to the tools I already use?

Yes. We connect to your endpoint security tool and your ticketing system and send alerts there, with the reasoning behind every AI decision attached.

Q: How does pricing work?

Public and in US dollars: three plans (Watch from US$ 790 · Detect US$ 2,390 · Respond US$ 5,590+ per month) and add-on modules with list prices, on a 12-month contract. You pay by company size, not per asset: every domain the company owns, given or discovered, is covered. No sales call needed to know the price.

Q: Do you only alert, or do you take the fraud down too?

On Respond or with the takedown module, we take it down: we gather the evidence, contact the registrar and the host, follow up until the site, profile or app is offline, and take it down again if it comes back.

Q: How do I know the AI didn't make up an alert?

Every decision comes with the explanation of why it was made, and we measure, customer by customer, how often it is wrong. The opposite of a black box: you see the reasoning.

Q: What does the AI do on its own, and what goes through a person?

The AI triages alerts, summarizes critical incidents and writes the monthly report, without inventing numbers: every figure comes from the platform. The copilot investigates with you, and research expands on its own with every finding. But no rule changes, no playbook goes live and no intrusive action happens without human approval.

Q: What do you need from me?

Your domains and brands. The rest is searching public sources and the underground, plus optional connections to your security and ticketing tools when you want response.

Leaked credentials, gaps in your attack surface and abuse of your brand, connected into one story, with response. Easy to understand, fast to act on.

See a live demo → See plans and pricing

5 frontsONE DASHBOARD

US$ 790PER MONTH, PUBLIC PRICE

<90sP95 LATENCY

4hGUARANTEED ONBOARDING

INCIDENT · L-2026-0341P1 · CRITICAL

Corporate account at risk

[email protected] · window 6d 4h

6 daysLeak: a company password found in an infostealer log

3 daysSurface: a new company host went public

18hGap: the server's remote access was left open

12 minAlert: someone logged in from outside, and it worked

4 clues that fit together94% · ACCOUNT TAKEOVER

The AI shows the why of every step · in 3.4s · nothing made up

EXAMPLES

Access password exposed · infostealer log Lookalike domain registered · brand + "login" Clone site taken down · offline Vulnerability being exploited · internal portal Paid ad abusing the brand · on Google Company password for sale · underground Fake profile removed · Instagram File leaked in the cloud · open bucket Pirate TV list with your channel · GitHub Fake app reported · app store

What we find

Five fronts, and a surface that keeps growing on its own.

You pay by company size, not per asset. Every new domain, vendor, subdomain, IP or app we discover is monitored right away, without becoming a line on your invoice.

01 · CREDENTIALS

Leaked passwords

Your company's passwords in infostealer logs and data dumps: the master password that opens several systems, apps the team uses without IT knowing (shadow IT) and logins leaked from third-party portals.

02 · SURFACE

Exposed gaps

Every host, system and version your company exposes to the internet, and your vendors' too, matched against the vulnerabilities already used in attacks.

03 · UNDERGROUND

Dark web signals

Forums, credential markets and leaks where your brand or your data circulate, before they turn into fraud.

04 · BRAND

Brand abuse

Lookalike domains, fake profiles and ads. We read the content and unfold the links, not just the name. Fake apps, fake stores and your files left open in the cloud.

05 · RESPONSE

Takedown

From discovery to offline: we gather the evidence, contact whoever hosts the scam and follow up until it falls. On Respond or as a module.

One story

The platform joins all five into a single case, and the AI writes the story of what is happening, showing the why instead of a black box.

how it works

From signal to resolved case, in six steps Λ

We search everywhere your brand shows up, separate what matters and hand back each threat already told as a story, with the takedown under way and you in the loop.

01

Collect

Lookalike sites, exposed surface, dark web and vendors.
02

Investigate

Reputation, history and the missing context.
03

Detect

Rules and AI separate threats from noise.
04

Connect

Loose signals become one case, summarized by the AI.
05

Posture

An A–F health grade: your brand at a glance.
06

Respond

We start the takedown and let you know.

The difference: we widen the surface you can see (vendors, shadow IT, social networks and dark web) and turn every event into a case ready for a decision.

Agentic operation

Agents work around the clock. People decide.

The platform doesn't wait for someone to look: it researches, triages, summarizes and writes on its own. Anything that changes a rule or touches your environment goes through human approval.

RESEARCH

Investigation that expands

Every finding opens the next investigation. Intrusive ones wait for your OK.

TRIAGE

AI triage

Verdict, severity and confidence for your EDR alerts, with the why.

COPILOT

Analyst copilot

Ask in plain language. It investigates with your data and proposes; you confirm.

SUMMARY

Incidents already summarized

Every critical case arrives with the story told in a few lines.

REPORT

AI-written report

No made-up numbers: every figure in the report comes from the platform.

AUTOMATION

Playbooks on request

Describe it in plain language. The playbook starts in test mode and only goes live after two approvals.

No rule changes, no playbook goes live and no intrusive action happens without human approval.

What you get

Not a loose alert. A connected story.

Every threat arrives already assembled as an incident: the whole chain, from the first signal to the takedown, with the why, not just the what.

Incident · L-2026-0417

Cloned brand turned into credential theft

Critical Containing

Someone registered a domain almost identical to the insurer's, which became a fake page copying the brand; soon after, customer credentials started leaking on a Telegram channel. The site takedown is already under way, and the case is being contained.

Aug 11 · 03:42
A domain resembling the brand's was registered

Brand
Aug 11 · 09:15
A fake page copying the brand went live

Exposed surface
Aug 13 · 21:08
Customer credentials started leaking

Dark web · Telegram
Aug 15 · 10:12
The site takedown is already under way

Action · takedown requested

Data privacy

Personal data, under control.

Whatever we find about people (customers, employees, executives) is treated as personal data from the moment it is collected.

Export and deletion

We honor data subject requests: we export or delete everything the platform holds about that person.

Masking

Sensitive data shows up masked in the dashboard and in alerts.

Retention

Each type of data has a defined retention period and leaves the database when it expires.

Use cases by industry

The same engine, the risk that looks like your industry.

The threat changes clothes depending on the market. See where it shows up in yours.

Healthcare & Insurance

Fake brokers selling policies in your name, member portal passwords leaked, lookalike domains harvesting data.

fake broker
portal password
impersonating profile
sensitive data

Banking & Fintech

Phishing pages with your brand, fake apps in the store, customer passwords for sale in the underground, scam ads on Google.

phishing page
fake app
password for sale
scam ad

Retail & E-commerce

Counterfeit products using your photos, clone stores, unauthorized resellers undercutting your minimum price.

counterfeit
clone store
grey-market resale
price undercut

Media, Telecom & Sports

Content piracy: pirate TV lists on GitHub, illegal game streams on YouTube, your event airing for free.

pirate TV
illegal streaming
copyright
takedown

Manufacturing & Technology

Pirated software and license generators circulating, plant systems exposed, vendor passwords leaked.

pirated software
exposed systems
unauthorized app
file in the cloud

Government & Critical infrastructure

Everything exposed to the internet watched, server passwords in the underground, the brand used in scams against citizens.

internet exposure
exposed password
citizen scams
underground

Why Lelantus

No black box, no pricing in the dark.

Aspect	The usual	Lelantus
Coverage	Per asset: you pay per brand, domain, VIP	By company size. Every domain it owns, including the ones we discover, is included.
Price	Opaque, by analyst hours	Public and fixed, in US dollars
Getting started	2 to 12 weeks	4 hours, guaranteed
Alerts	Loose, one per tool	One incident story
AI decisions	Black box	Shows the why of every decision
Operation	Paid analyst hours	Agents around the clock; people approve
Focus	Enterprise budgets	Mid-market companies

Pricing

Prices on the table. Pick what you need.

You pay by company size, not per asset. 12-month contract. Month-to-month: +15%. Every plan includes the dashboard and alerts.

Founder pricing · the first 10 customers lock their price for 24 months, with no setup fee

WATCH

US$ 790/mo

Up to 500 employees.

1 brand and every company domain, including the ones we discover
Leaked and infostealer credentials
Deep and dark web
Everything exposed to the internet, IPs included
Alerts by email, Slack, Teams and WhatsApp
Dashboard and monthly report
Response within 1 business day

Get started

DETECT

US$ 2,390/mo

The full engine: the platform connects the signals and the AI triages for you.

Everything in Watch, no limits
Signals connected into one story
AI that triages alerts for you
The why of every AI decision
Connects to your security and ticketing tools
Triage in under 90 seconds, day and night

Get started

RESPOND

US$ 5,590+/mo

A team alongside you: response, takedown and threat hunting.

Everything in Detect
Dedicated specialist
Incident response + fraud takedown
Tailored action plans
Quarterly threat hunting
Contractual SLAs, with penalties if we miss them

Talk to sales

Add-on modules

Add to any plan, under the same contract.

Module	Per month
Additional branddark web and infostealer	US$ 650
Executivesup to 10 people	US$ 240
Takedownup to 60 per year	US$ 180
Code secretsin public repositories	US$ 60

For MSSPs and partners

Resell Lelantus with a margin.

Special terms for those who already run their clients' security. Your SOC can handle first-level triage in our console, and we bring the platform, the intelligence and the takedown.

Resale terms below list price
First-level triage in the partner's SOC
One product, one console, for all your clients

Become a partner →

FAQ

What people ask before getting started.

Do I need a security team to use it?

No. On Watch you follow everything yourself in the dashboard; on Detect the AI triages alerts for you; on Respond one of our specialists works alongside you. You choose how much to outsource.

How long does it take to get started?

Four hours. You give us your domains and brands and the search starts. No multi-week project, no mandatory consulting.

Does it connect to the tools I already use?

Yes. We connect to your endpoint security tool and your ticketing system and send alerts there, with the reasoning behind every AI decision attached.

How does pricing work?

Public and in US dollars: three plans (Watch from US$ 790 · Detect US$ 2,390 · Respond US$ 5,590+ per month) and add-on modules with list prices, on a 12-month contract. You pay by company size, not per asset: every domain the company owns, given or discovered, is covered. No sales call needed to know the price.

Do you only alert, or do you take the fraud down too?

On Respond or with the takedown module, we take it down: we gather the evidence, contact the registrar and the host, follow up until the site, profile or app is offline, and take it down again if it comes back.

How do I know the AI didn't make up an alert?

Every decision comes with the explanation of why it was made, and we measure, customer by customer, how often it is wrong. The opposite of a black box: you see the reasoning.

What does the AI do on its own, and what goes through a person?

The AI triages alerts, summarizes critical incidents and writes the monthly report, without inventing numbers: every figure comes from the platform. The copilot investigates with you, and research expands on its own with every finding. But no rule changes, no playbook goes live and no intrusive action happens without human approval.

What do you need from me?

Your domains and brands. The rest is searching public sources and the underground, plus optional connections to your security and ticketing tools when you want response.

See what's hidden about your brand.

In a 30-minute demo, we show real findings for your domain, with no commitment.