What does ransomware readiness mean?

Ransomware readiness describes how well an organisation knows and has closed the typical entry points of a ransomware attack, and how early it detects warning signals before encryption and extortion begin. It is not about recovery after the incident but about the phase before it. Typical entry points are exposed remote access, unpatched perimeter systems, stolen credentials and session cookies, forgotten systems, misconfigured cloud and backup systems, and compromised service providers.

What is an initial access broker?

An initial access broker (IAB) is a criminal service provider specialising in the first foothold: they compromise companies via exposed services, leaked credentials or vulnerabilities and sell the finished access, for example VPN or RDP access with domain privileges, to ransomware groups in underground forums. blacklens.io monitors these sources and matches them against your domains.

Is MFA enough to prevent ransomware?

MFA is the single most important measure against account takeover, but not complete protection. Stolen session cookies from stealer logs bypass MFA as long as the session is valid, and exploits in firewalls or VPN appliances do not need an account at all. That is why blacklens.io combines the IAM inventory with dark web monitoring and vulnerability scans.

How quickly do we find out if our company is on a leak site?

Leak sites are polled about every 30 minutes. On a match for your company or a supplier from your watchlist you receive an alert by email, push, Teams, Slack or in your SIEM, with actor, post and screenshot. Each entry also contains company, sector, domain and country. Alerts are collected every five minutes and distributed according to your notification policies.

Does blacklens.io also help after an attack?

blacklens.io is an early warning and prevention tool, not an incident response or backup product. After an incident, the platform helps you find remaining entry points and further compromised identities, prove hardening via retest and show your forensics partner the attack surface at the time of the incident.

How is this different from EDR?

EDR watches endpoints from the inside and detects attacks in progress. blacklens.io sees your company from the outside: exposed services, exploitable vulnerabilities, traded access. The two complement each other; blacklens.io closes the doors, EDR raises the alarm if someone gets in anyway. blacklens.io needs no agents on endpoints for this; internal scans run via the Sentry scanner in your network.

What do we do about a stealer log finding?

The finding contains hostname, operating system, installed antivirus software, stealer path and infection date. Reset the affected passwords, terminate active sessions, reimage the device and check whether it is a private device with company access. Explainable AI summarises these steps for every finding.

Which other entry points does blacklens.io check?

Beyond the external attack surface, the dark web and leak sites, blacklens.io detects publicly accessible cloud storage, public IPs and API endpoints in AWS, Azure, Microsoft 365 and Google Cloud. The IAM inventory shows identities without MFA capability or phishing-resistant authentication, privileged roles and stale accounts from Entra ID, Google and Active Directory. Certified pentesters validate the most critical entry points manually and confirm the fix with a retest.

Solutions

Ransomware readiness: close entry points early

Ransomware readiness means closing entry points before encryption and extortion begin. blacklens.io finds them from the attacker's perspective and warns you of leak site matches.

Start free trial Book a demo

Attack surface of beispiel-gmbh.at

Exposure score 71/100

Assets

112

Services

critical

Criticalvpn.beispiel-gmbh.atFortiGate SSL-VPN 7.0.12CVE-2024-21762, KEV

Highmail.beispiel-gmbh.atExchange 2019 CU12EPSS 0.91

Highdev-old.beispiel-gmbh.atGitLab 15.2, Shadow ITUnknown asset

Mediumshop.beispiel-gmbh.atnginx 1.24, TLS 1.2Certificate expires in 9 days

Highbeispiel-gmbh-login.comLookalike, registered 3 days agoPhishing preparation

Dark web: compromised identities

m.huber@beispiel-gmbh.atStealer-Log (RedLine), 2 h ago

Session-Cookie M365Combolist, yesterday

Sample data. Get your own view with the exposure check.

How a ransomware attack unfolds

Ransomware rarely starts with ransomware. Days to weeks often lie between the sale of the access and the attack.

1
Initial access
Access brokers use exposed services, leaked credentials or fresh vulnerabilities.
2
Sale in the underground
The finished access is sold to ransomware groups in underground forums.
3
Attack and data theft
The group uses the access and exfiltrates data, often days to weeks after the purchase.
4
Extortion via leak site
The victim is listed on a leak site and extorted with the publication of data.

Entry points blacklens.io finds

Prioritised by what ransomware groups actually exploit.

Newly discovered assets+4 since yesterday

beispiel-gmbh.atRoot domain

vpn.beispiel-gmbh.atFortiGate SSL-VPN 7.0.12Critical

dev-old.beispiel-gmbh.atGitLab 15.2Shadow ITHigh

mail.beispiel-gmbh.atExchange Server 2019Medium

203.0.113.24OpenSSH 8.9NewInfo

Fix firstsorted by risk

1CVE-2024-21762vpn.beispiel-gmbh.atKEV

2CVE-2024-21410mail.beispiel-gmbh.atKEV

3TLS 1.0 enabledshop.beispiel-gmbh.atMedium

Compromised identities3 new hits

m.hu•••@beispiel-gmbh.atStealer log, 2 h agoEmployee

Microsoft 365 session cookieStealer log, 5 h agoEmployee

k.wa•••@gmx.atCombolist, 3 days agoCustomer

Supplier watchlist12 suppliers

Logistik Partner GmbHListed on a ransomware leak site, 30 min agoCritical

Software Zulieferer AGSoftwareNo hits

Muster SteuerberatungTax advisoryNo hits

Sentry in the internal networkonline

Servers423 critical

Clients186

OT & IoT172 critical

Network91 critical

Active Directory12 accounts without sign-in for 90 daysMedium

Visuals show sample data.

Results from practice

Early warning works when it comes before the attack. Alerts are collected every five minutes and sent by email, push, Teams, Slack, Jira, ServiceNow or to your SIEM.

Early warning47 min ago

CVE-2024-21762FortiOS SSL-VPNCritical

CVE published08:12
2 assets in your inventory affected09:00
Confirmed by PoC scan09:26
Alert sent to Microsoft Teams09:27

Visuals show sample data.

Login subdomain on a leak site
A SaaS provider found a subdomain considered inactive internally in a ransomware group's leak.
ProxyShell, 48 hours before the attack
A manufacturer patched after the alert, 48 hours before an automated attack.
Partner access visible for the first time
An IT service provider saw all exposed services including partner access and hardened them.

Frequently asked questions

: Ransomware readiness describes how well an organisation knows and has closed the typical entry points of a ransomware attack, and how early it detects warning signals before encryption and extortion begin. It is not about recovery after the incident but about the phase before it. Typical entry points are exposed remote access, unpatched perimeter systems, stolen credentials and session cookies, forgotten systems, misconfigured cloud and backup systems, and compromised service providers.
: An initial access broker (IAB) is a criminal service provider specialising in the first foothold: they compromise companies via exposed services, leaked credentials or vulnerabilities and sell the finished access, for example VPN or RDP access with domain privileges, to ransomware groups in underground forums. blacklens.io monitors these sources and matches them against your domains.
: MFA is the single most important measure against account takeover, but not complete protection. Stolen session cookies from stealer logs bypass MFA as long as the session is valid, and exploits in firewalls or VPN appliances do not need an account at all. That is why blacklens.io combines the IAM inventory with dark web monitoring and vulnerability scans.
: Leak sites are polled about every 30 minutes. On a match for your company or a supplier from your watchlist you receive an alert by email, push, Teams, Slack or in your SIEM, with actor, post and screenshot. Each entry also contains company, sector, domain and country. Alerts are collected every five minutes and distributed according to your notification policies.
: blacklens.io is an early warning and prevention tool, not an incident response or backup product. After an incident, the platform helps you find remaining entry points and further compromised identities, prove hardening via retest and show your forensics partner the attack surface at the time of the incident.
: EDR watches endpoints from the inside and detects attacks in progress. blacklens.io sees your company from the outside: exposed services, exploitable vulnerabilities, traded access. The two complement each other; blacklens.io closes the doors, EDR raises the alarm if someone gets in anyway. blacklens.io needs no agents on endpoints for this; internal scans run via the Sentry scanner in your network.
: The finding contains hostname, operating system, installed antivirus software, stealer path and infection date. Reset the affected passwords, terminate active sessions, reimage the device and check whether it is a private device with company access. Explainable AI summarises these steps for every finding.
: Beyond the external attack surface, the dark web and leak sites, blacklens.io detects publicly accessible cloud storage, public IPs and API endpoints in AWS, Azure, Microsoft 365 and Google Cloud. The IAM inventory shows identities without MFA capability or phishing-resistant authentication, privileged roles and stale accounts from Entra ID, Google and Active Directory. Certified pentesters validate the most critical entry points manually and confirm the fix with a retest.

Dark Web Monitoring

Compromised identities, devices and data leaks, matched daily.

Supply chain monitoring

Ransomware victims in your supply chain, checked about every 30 minutes.

NIS2

Evidence incident handling and business continuity technically.

Cyber insurance

Answer insurers' questions on MFA, patches and attack surface.

Do you know what an access broker finds about you?

Start with your domains. Within 24 hours you see exposed access, vulnerable systems and traded credentials.

Try free for 14 days Book a demo

14 days free, all features
No credit card required
We walk you through your first findings