Someone is already looking at what you expose. Aeon shows you what they can find.
Aeon is an External Digital Trust Posture Management platform that assesses your digital trust exposure, including public AI assistants, from the outside.
Illustrative estate. Names are fictional.
Three attempts. One week.
Not one of these needed anybody at the company to click the wrong thing, open the wrong file or ignore a warning.
Northwind Group is not a real company. Every name, figure and screen on this page is an illustration.
Your finance team pays a stranger $240,000, on an instruction from your finance director.
The email comes from your finance director's own address, not a lookalike.
Anyone can send an email that claims to be from her, because your domain has never published the record that tells mail systems to refuse messages that are not really yours.
The email asks accounts payable to pay an invoice to new bank details before Friday's payment run. They pay it.
It arrives with your instruction to refuse it. Wherever it arrives.
Aeon never sees the email. What it found on Monday was the missing record, and it put that first on your list.
It had also checked that all of your real senders would still get through after the change. Companies often skip that check, and that is how they end up blocking their own invoices.
Your team published the record on Tuesday. On Wednesday Aeon checked from the outside and confirmed it was live. From then on, any email that only claims to be from her carries your instruction to refuse it.
The assistant on your homepage hands over your commercial terms.
A visitor types a paragraph into the chat box telling it to ignore its instructions.
It does as it is told. It prints the rates you hold with your three largest accounts.
It declines, and offers to help with an order instead.
Aeon had already tried this on your assistant, the way a stranger would. It was second on Monday's list, with the fix.
Fixed on Tuesday. Since then Aeon has tried again on every assessment, in more than twenty ways. It has held every time.
No assistant can be guaranteed never to give in. If yours ever does, it goes straight back on your list.
Castlereach 25%, Vantor 40%, Ellisgrove 60%Shall I apply one to your account?A stranger puts a sign-in page on your own domain.
Three years ago you ran a campaign on a web address of your own. The campaign ended and the site was taken down, but the address was never removed. It still points at a hosting account that nobody pays for any more.
On Tuesday a stranger takes over that hosting space. By the evening there is a sign-in page on your address, with your name, your logo and a padlock, asking people for their passwords.
Nothing about it looks wrong. It is your domain.
The stranger gets an empty space. There is nothing of yours to take.
Aeon checks every address you own, including the ones everybody has forgotten about. On Monday it found this one still pointing at hosting that nobody was paying for, and put it third on your list.
On Tuesday morning your team removed the address. Aeon checked again from the outside and confirmed it no longer leads anywhere.
When the stranger took over the hosting space that afternoon, there was no address of yours pointing at it. Their page reached nobody.
Sign in to Northwind
Your name. Your domain. A real padlock. Somebody else's page.
Everything you put in front of the public. Tried the way the public tries it.
Two surfaces, one standard. If a stranger can reach it under your name, Aeon tries it before they do.
Every name that answers as you.
Including the ones that left everybody's list and are still live.
- Mail in your nameA message that only claims to come from you carries your published instruction to refuse it, wherever it arrives.
- Sign-ins from anywhereEvery sign-in page is checked for accepting an unprotected connection, and for whether it tells browsers to refuse the downgrade.
- Addresses you forgotThe one left over from an old campaign is found before a stranger claims it and puts a page on your domain.
- Who can act as youOnly the certificate authorities you name are permitted to issue for you, and you are told when one of your addresses starts pointing somewhere new.
The assistant on your homepage is a front door.
Aeon talks to it the way a stranger would, on every assessment, and reports what it gave away.
- It keeps to its rulesA visitor tells it to ignore them. It carries on as you built it.
- It keeps what you told itPricing, discounts, instructions and internal notes stay inside.
- It cannot be talked into overreachNobody else's record, and no action it was never meant to take.
- It holds under pressureRephrased, disguised, repeated and role-played attempts, tried again on every assessment, and reported the day one gets through.
- Every window it opensThe places it connects to are found, and the ones you authorise are tested with it.
Tried from the outside. Never from the inside.
Aeon reaches your domains and your assistant the way a stranger does.
Aeon reaches each domain and assistant from the public internet, the same way anyone else can. Nothing is installed and no credentials are needed.
Aeon records what it tried, when it tried it, and what came back, so there is a record for your audit.
Aeon watches every domain daily for changes, runs a full assessment on a set schedule, and tries every fix again before it marks it closed.
Aeon never installs anything on your systems. There is no agent, no plugin and no script to run.
Aeon never holds a key, a login or a password to any of your systems. It only ever sees what the public can see.
Aeon never changes a record or a setting, and it never sends email in your name. Every fix is made by your own team.
Your application is ready to send
Your mail app should now be open with the application addressed to . Send it and you are done.
If nothing opened, copy the text below into an email to that address.
Application received
Thank you. Applications are reviewed individually and in the order received. If approved, you will receive an email invitation with access details.