Risk score 0/100 Open
PhishRoot · security operations platform
Enterprise Security. For MSPs & MSSPs.Real Enterprise Security. Built for MSPs & MSSPs.
Audit a prospect's domain in under a minute, hand over a branded report, then manage every client organization from one portfolio view — with the PhishRoot SOC behind your team. Your clients stay yours.
Passive analysis · No agents · No exploit traffic · Free plan included
Sample findings, demo data
Built for lean security teams
Exposure management without the enterprise price tag or the agent rollout.
Passive analysis
Findings come from public signals and read-only imports — nothing is probed or exploited.
No agents
First findings without installing anything on a server or device.
Private workspaces
Every customer's findings stay inside their own organization.
Free to start
Scan a domain and save up to 10 findings on the free plan.
PhishRoot in plain English
One security guard. One clipboard.
Most companies check ten different tools to know if they are safe. PhishRoot looks at your accounts, laptops, cloud and code for you, and puts every open door on one simple list, most urgent first.
Yuna Kim · Security Researcher
A one-minute tour of PhishRoot
Transcript
Hi, I'm Yuna Kim. Let me give you a quick tour of PhishRoot. Risk Radar shows your exposure through passive analysis. No agents and no exploit traffic. The scanner checks public DNS, SPF and DMARC, HTTPS, and security headers. Scans need a free account. Identity, Endpoint, and Cloud work from imported snapshots. Demo results aren't saved. Secrets scans code locally. Respond tracks imported incidents. Continuous testing stays passive, and reruns weekly on paid plans. Start on the free tier at phishroot.com. You've seen how PhishRoot helps you review risks and track fixes. Please watch our other video series. The off-camera narration uses a different synthetic voice from the presenter.
- 1
Spot
It connects to the apps you already use and spots open doors, like a forgotten password or a public file.
- 2
Prioritize
It tells you what is an emergency today and what can wait until next week.
- 3
Close
It gives you a one-click fix, or pings the right teammate, before an attacker notices.
Findings workflow · illustrative example
Found at 09:41.
Closed at 09:45.
PhishRoot does not hand you a list to work through. Each finding arrives with an owner, a plain-language fix and a status you can track until it is closed.
- Assign each finding to a teammate
- Rescan to confirm a fix actually closed it
- Export findings and history for audits
Times shown are an example, not measured customer results
- 09:41
Stale admin account
Left the company 212 days ago and is still a global admin
Identity · High
open
- 09:38
Secret in a build log
A database password printed by a CI job
Secret · Critical
open
- 09:35
Forwarding rule to a personal inbox
Finance mail copied outside the company
Identity · High
open
- 09:32
Expired TLS certificate
The partner API certificate lapsed last night
Network · Medium
open
- 09:29
Unused service account
Owner role on the billing project, idle for 96 days
Identity · High
open
- 09:26
Public S3 bucket
Customer exports readable without a login
Cloud · Critical
open
- 09:23
Phone · no screen lock
Reads company mail without a passcode
Endpoint · Low
open
Sample findings, demo data
Coverage
Four surfaces.
One watch.
Every employee, contractor and service account, with what each can reach and when it was last used.
- Stale accounts
- MFA gaps
- Shared passwords
- Admin sprawl
Identity · High
Stale admin account
Identity · Medium
Shared admin password
Identity · High
Contractor · MFA off
Products
Five products, one list of what is exposed.
Start with the surface that worries you most. Every product writes into the same findings list, so nothing has to be stitched together later.
1IdentitiesOpenIdentity
Review account access and authentication gaps.
- Input
- CSV / JSON snapshots
- Checks
- MFA, inactive accounts, admin access
- Remediation
- Assigned, tracked and reviewed
2DevicesOpenEndpoint
Review devices that have fallen behind.
- Input
- CSV / JSON device inventory
- Checks
- Encryption, locks, patches, protection
- Evidence
- Imported device settings
- CloudOpen
Cloud
Review public resources and cloud settings.
- Input
- CSV / JSON resource inventory
- Live tool
- Public domain scanner
- Checks
- Exposure, encryption, logging, permissions
- Code & secretsOpen
Secrets
Find potential keys and tokens in code.
- Input
- Pasted code or source files
- Detectors
- 8 credential pattern families
- Privacy
- Raw credentials are never uploaded
- Detection & responseOpen
Respond
Track incidents from first signal to closed.
- Input
- CSV / JSON incident records
- Workflow
- Assign, investigate, resolve
- Evidence
- Organization activity log
One incident, two endings
The same leaked key. Two very different endings.
A cloud key is pushed to a public repository on a Tuesday afternoon. What happens next depends on whether anyone is watching.
0
Days before anyone noticed
Without PhishRoot
Found on day 212Day 0
Key pushed to a public repo
A deploy script with a live cloud key lands in a public repository.
Day 3
Copied by a scraper
Automated scanners pick the key up. Nobody is told.
Day 41
First quiet login
The key is used from a new country to list storage buckets.
Day 130
Customer records copied
1.2 million rows leave over nine nights.
Day 212
Found by a customer
A customer reports their data for sale. The clock starts now.
With PhishRoot
✓ Closed in 4 min0:00
Key pushed to a public repo
0:40
Finding opened
1:30
Owner paged
3:10
Key revoked
4:00
Closed
Illustrative scenario, not a customer result
Integrations
Connects to what you already run.
Read-only access, no agents to roll out for the first findings. Most teams connect their identity provider and one cloud account in the first hour.
0 / 12 connected · Read-only by default · no credentials stored
In numbers
What gets measured gets closed.
What the platform does today. Your own numbers sit on the first screen of the product.
Time to first scan
< 1 min
Enter a domain and see its public exposure grade in seconds.
Products
5
Identity, Endpoint, Cloud, Secrets and Respond in one workspace.
Free plan
10 findings
Save and track real findings before you ever pay.
Monitoring
Daily
Paid plans re-check your assets every day and email what changed.
Scenarios
What a first week can look like.
Four illustrative scenarios built from common exposures. They show the workflow — they are not customer results.
Closed
340
orphaned accounts to close in week one
How PhishRoot is sold
Through your MSP. Never against them.
PhishRoot is 100% channel: businesses get the platform from the MSP or MSSP that already looks after them. Your partner sets the retail price and stays your single point of contact, with the PhishRoot SOC behind them. We never sell direct and never undercut a partner.
Team
Self-managed: you see the risks and fix them.
- Self-managed platform
- Identity and Endpoint
- Daily sweep
- Slack and email alerts
- 90 days of history
- Community support
Business
Most chosenSelf-managed with SOC backup: your team runs day to day and escalates incidents to the PhishRoot SOC.
- Everything in Team
- Cloud and Secrets
- Continuous sweep
- Network checks and incident and ticket queue
- PhishRoot SOC: investigation of incidents you escalate
- Jira and PagerDuty
- Evidence exports for audits
- 13 months of history
Enterprise
Co-managed: the PhishRoot SOC works alongside your team around the clock.
- Everything in Business
- PhishRoot SOC: 24/7/365 "Follow The Sun" proactive monitoring, investigation and agreed response
- Respond with custom playbooksplanned
- Single sign-on and SCIMplanned
- Private data regionplanned
- Named engineer and 1-hour responseplanned
No prices are published: wholesale terms are agreed with each partner. Ask your MSP about PhishRoot, or contact us and we will introduce you to one. Items marked planned are on our roadmap and not available today. Custom playbooks and named-engineer support are not currently offered; no 1-hour response is guaranteed. Business SOC coverage covers investigation and remediation guidance for incidents your team escalates; it does not include proactive monitoring, and your team applies the fixes. Enterprise adds 24/7/365 proactive monitoring and agreed response. Response targets are agreed in the service agreement.
What we build toward
The first sweep should pay for the year.
The outcomes every PhishRoot feature is designed to deliver.
Goal 01
“Find the global admin who left seven months ago — before an attacker does.”
Questions
Asked before every rollout.
What security and IT teams want to know before they connect the first source.
Connect your identity provider and most teams see their first findings in under an hour. Cloud accounts and device managers each add a few minutes. Nothing is installed on a server to get started.
Start here
Scan your domain.
Risk Radar reads only public signals: DNS records, email policies and your site's HTTPS response. Create a free account to run the scan and save up to 10 findings.
Risk Radar checks
- SPF and DMARC email spoofing protectionPassive
- Mail servers and certificate authority recordsPassive
- HTTPS and certificatePassive
- Security headersPassive