Datahorses moves the first line of cyber defence outside the company network

For most of the past two decades, buying cyber security meant buying software that runs inside the company: antivirus on every laptop, then endpoint detection and response (EDR) and extended detection and response (XDR) platforms that watch processes, logins and network traffic. Datahorses, a security company that grew out of the Functu software group, is built on a different premise. Its service, which it calls Guarding, does not install anything and does not ask for passwords. It watches a client from the outside, the way an attacker would, and raises an alarm when something visible on the internet changes or looks exploitable.

The approach matters because a growing share of corporate exposure no longer sits on devices a company manages. Domains, DNS records, certificates, email settings, marketing sites run by agencies and test servers that were never switched off all live outside the reach of an endpoint agent. They are also, as the MITRE ATT&CK framework notes in describing reconnaissance as the first stage of an attack, exactly what an adversary studies before choosing a target.

What Datahorses actually does

Datahorses describes itself as a first line of defence for the early detection of cyber threats. According to the company, it catches the first signs of an attack such as website compromise, stolen credentials, data leaks, break in attempts, company identity theft and social engineering. A client supplies a list of domains, subdomains and public IP addresses; nothing else is required. The company says it uses dozens of its own tools to watch those assets.

The scope is published in unusual detail. The list of what Datahorses guards runs to 100 items in 10 areas: AI attack defence; servers, software and website; DDoS resilience; data leaks and company accounts; fraud in the client's name and identity theft; blocklists and browser warnings; domains, DNS and certificates; email; subdomains and forgotten services; and online reputation. Each item states what is checked, which source is used and how often. Core checks run twice a day, in the morning and the evening, without entering the client's systems.

The findings are concrete. The company lists leaked company login credentials, lookalike and typo domains, fake login pages and invoices sent in a client's name, impersonation of management, exposed backups and .git or .env files, visible admin panels and open remote desktop, SSH and database ports, known vulnerabilities in software and plugins, and gaps in the SPF, DKIM and DMARC records that decide whether someone else can send email that looks like the client's.

Why outside in is becoming a category

The commercial logic is that external monitoring answers a question endpoint tools were not designed to ask. Datahorses is explicit that it does not replace them. In its own comparison of attack surface monitoring and EDR or XDR platforms, the company frames the difference as direction: endpoint tools start from devices a company knows about and watch them closely, while external monitoring starts from what the internet shows and works back to what the company owns. A changed nameserver, a domain close to expiry, a missing DMARC record or a forgotten staging site at an agency happen at a registrar or on someone else's infrastructure, and never appear on an endpoint console.

That distinction maps onto the NIST Cybersecurity Framework 2.0, which Datahorses cites. Endpoint platforms do most of their work in the Detect and Respond functions; external monitoring feeds Identify, meaning knowledge of assets and exposure, and Protect, meaning fixing weak settings before they are used. For a mid-sized company that already pays for an EDR licence, the pitch is an additional layer rather than a second copy of the same capability.

Two further features distinguish the model from a periodic vulnerability scan. The first is that it is continuous. Datahorses argues that a report from last spring describes last spring, and that the value lies in noticing change: a new subdomain, a nameserver nobody requested, a certificate issued without explanation. The company reminds clients 30, 14 and 3 days before a domain or certificate expires. The second is that it is non-intrusive. Datahorses states that it does not guess passwords, does not attack and puts no load on a client's servers, which places it clearly apart from a penetration test that needs written authorisation and runs for a fixed period.

Artificial intelligence on both sides

The newest part of the service addresses a change in how attacks are prepared. Datahorses notes that attackers increasingly use AI to examine a company from the outside, and its AI Attack Defence area, 11 items in total, has current AI models assess the same external view once a week. The models look for chains of small findings that an attacker could combine, for example a forgotten subdomain running old software alongside weak email settings, and rank open findings by how easily they could be abused.

Other checks in the same area read the JavaScript a website sends to every visitor for keys, tokens and internal endpoints; estimate how much public audio and video of executives exists that could be used to imitate a voice or a face; and assess whether a website chatbot exposes internal instructions or could be manipulated through prompt injection. The company also builds a likely fake invoice or executive impersonation scenario from what is visible about a business, together with a measure that would stop each step. It says it sends such scenarios to no one and tries nothing against the client's systems.

Automation is paired with people. According to Datahorses, every critical incident is also reviewed manually by one of its specialists, who then contacts the client with next steps. Clients receive their own dashboard with the progress of checks, findings and fix instructions written for a developer or administrator. Alerts go out by email, and by text message if the client chooses. After an offer is accepted, guarding starts and the dashboard is prepared within 72 hours.

The Functu connection

Datahorses traces its origins to Functu, a software company founded in Sydney in 2004. In its account of how the company started, Datahorses says its team came together on December 4, 2020, as a group of developers specialising in security inside Functu. As more clients sought security work, the team became a company of its own, founded in the United States, with a European entity following later. Datahorses says it remains part of the Functu group and that security is now all it does.

The company is led by its founder and chief executive, Juraj Andrascik, who was named to the Forbes 30 Under 30 list. Its website lists Microsoft Partner and Intel Software Partner credentials, which it attributes to the Functu group, and country sites in 13 markets, from the United States to Finland. Datahorses says it works with hundreds of clients.

Our view

Datahorses is a clear example of a shift that is easy to miss because it involves no new hardware. Security spending has long been organised around devices, yet much of the risk a company carries now sits in records, registrations and services that no agent can see. A model that inventories that surface continuously, explains each finding in plain language and asks for no access lowers the barrier for companies that have neither a security team nor the appetite for another installation. The use of AI to anticipate how an attacker with similar tools would read a company is a sensible extension rather than a gimmick, provided findings continue to be checked by people, as Datahorses says they are. The limits should be stated as plainly as the strengths: outside in monitoring does not stop malware on a laptop and does not filter a DDoS attack, which Datahorses itself acknowledges. For boards weighing where the next unit of security budget should go, the more useful question is no longer which endpoint product to buy, but who is watching the company from the outside.

Sources

• Datahorses: Guarding, early detection of cyber threats
• Datahorses: Attack surface monitoring vs EDR and XDR
• Datahorses: What external attack surface monitoring is (and what it is not)
• Datahorses: How Datahorses started

Filed under Cybersecurity. Written by InvestTimes Editorial under our editorial standards. Commentary and analysis for information only, not investment advice.