Free tool · 1 to 3 minutes

See where your public data meets your detection gaps.

This diagnostic maps publicly available organizational data against the attack types your email security can detect, and names the BEC and phishing variants you're missing. The full report renders here and is also emailed to your work address.

1Who are we checking?
The website domain you want recon performed against.
Your report is sent here. To prevent abuse, free providers (Gmail, Yahoo, Outlook, etc.) are blocked.
Helps the agents disambiguate when the domain is generic.
Used in the email greeting only.

2What's defending your inbox?

Email platform
If unsure, leave on auto-detect. We use MX records as fallback.
Protection layer
MX records reveal a gateway, but API-based protection sits post-delivery and only you know it's there. Skip this and the report defaults to native-only, which may overstate your blind spots. Gateway and ICES profiles assume modern deployments with ML augmentation enabled (Mimecast Nexus, Proofpoint NexusAI, Abnormal foundation model, etc.). A rules-only legacy gateway would have more blind spots than the report shows.
Cached domains return instantly.

Running six research agents on your domain

Each agent searches the public web for one of the six Corporate PDA information categories: organizational structure, vendor relationships, financial signals, technology infrastructure, personnel intelligence and trigger events.
Starting up…
Typical run takes 1 to 3 minutes. Cached domains return instantly.
✉
Your report
…
About this report

The model BEC operators implicitly follow.

The Corporate PDA Framework, authored by StrongestLayer Threat Research, names the 24 data types that show up in attacker pretexts and groups them into six categories. Public sources only. We never connect to your tenant.

A

Organizational Structure

Reporting hierarchy, approval thresholds, board composition, subsidiary structure.

B

Relationship & Vendor

Named vendors, banking, outside counsel, strategic partners.

C

Financial & Transaction

Payment cycles, active deals, transaction volumes, litigation.

D

Technology & Infrastructure

Identity provider, security stack, SaaS dependencies, DNS infrastructure.

E

Personnel & Behavioral

Executive voice, employee identities, schedule patterns, professional networks.

F

Event & Trigger

Leadership transitions, M&A activity, new vendor announcements, breach disclosures.

Dimension 1

Exposure Breadth

How many of the 24 data types are findable from public sources right now.

Dimension 2

Corroboration Density

How many independent sources confirm each exposed data type.

Dimension 3

Combination Coverage

Which max-risk attack combinations are fully armed by your exposure mix.

T1 Safe

Low public exposure. Attackers need significant additional reconnaissance.

T2 Low

Some exposure. Generic phishing risk, limited targeted-attack viability.

T3 Elevated

Multiple armed combinations. Targeted BEC and credential phishing viable today.

T4 Critical

Highly armed. A motivated adversary can execute multi-step attacks immediately.

Privacy. We query public sources only via web search. We do not connect to your mail tenant or any internal system. Reports cache for 7 days per domain, then auto-purge. The report email is sent from info@strongestlayer.org.
  • We won’t publish findings about your org.Your name and results never appear in our marketing, research, or case studies.
  • We won’t feed your results into our research or product.Your report is emailed to you and to our team, and it’s used only to talk with you about your results. It never enters our threat research, our product, or our models.
  • We won’t add you to our marketing lists.Your email address won’t be added to our newsletter or marketing email lists. Someone from our team may follow up to set up a conversation. If you’re not interested, we’ll take the hint.
Free AI gap check

Do you have an AI gap? Find out what’s getting through.

See which generations of defense you’re running and what it takes to close the gap. Two minutes. No signup. Nothing changes in your environment.

Book a demo Find my AI gap →