10 KRIs, 130+ sources, ~30 pages + annex.

Every IntelMind Cyber DD dossier covers the same ten Key Risk Indicators (KRIs) calculated over 130+ public sources with an outside-in methodology. No touching the target company's systems, no legal risk. Raw, verified data with its source documented: you bring the judgment and the signature.

The 10 Key Risk Indicators

Every KRI includes

• 0-100 score with a traffic-light rating (green/amber/red)
• What we found (concrete findings with evidence)
• What could happen (estimated economic impact)
• Recommended action (concrete steps + timeline + estimated mitigation cost)
• Priority (Day-0 / 30 days / Pre-close)
• Verifiable sources (public URLs to audit each finding)

How the dossier is structured

The PDF runs to about 30 pages plus the sources annex, and it reads top-down: you can stop after the first two pages or follow any finding all the way to its evidence.

1. Cover and identification: target company, report ID, issue date and the custody data that lets anyone check the file has not been altered.
2. Executive summary: a single page for the investment committee with the global score, how serious the risk is and the three KRIs that need attention first.
3. Ten KRI cards: one short card per indicator with what was found, what it could mean for the deal and what to do about it.
4. Detailed findings: the technical evidence behind each card, its estimated economic impact and a tailored recommendation.
5. Sources annex: the public URL behind every finding, so your team, the seller or an arbitrator can verify it independently.
6. Methodology and custody: how the data was collected, the SHA-256 hash of the file and its RFC 3161 timestamp issued by FreeTSA, with instructions to verify both.

Outside-in: what the dossier checks and what it does not

Everything in the report comes from public sources and from data that internet-wide services such as Shodan, Censys and Netlas have already indexed. We never log in to the target company systems or run intrusive tests against them, and the target is not notified. That is why the analysis can run before an LOI, or in a deal where the seller does not cooperate.

It also sets the limits of the product. The dossier is not a penetration test or an internal audit: it cannot see patch levels behind the firewall, internal policies or incident logs. What it gives you is an evidence-based view of the risk that anyone on the internet can see, which is also what an attacker sees first. When the deal reaches confirmatory due diligence with data-room access, use the findings to decide where the technical review should dig.

How each indicator feeds the deal

Every finding carries one of three priorities, and they follow the stages of a transaction:

• Day-0: issues that can change the decision or the price before signing. Typical examples are credentials already circulating, mentions on initial access broker markets, sanctions hits or a live phishing campaign against the customers of the target.
• Pre-close: findings to document in the SPA through specific representations, W&I clauses or price holdbacks, such as past breaches, regulatory fines or security-related litigation.
• 30 days: hygiene work for the post-closing plan, such as fixing SPF, DKIM and DMARC, removing dangling subdomains, closing exposed services or rotating secrets found in public repositories.

Because every dossier measures the same ten indicators, you can also compare targets on a like-for-like basis when you screen several at once. See who Cyber DD is for and download the anonymized sample dossier to check the depth before you order.