A non-transitory computer-readable medium having computer-executable instructions stored thereon, the computer-executable instructions, when executed by a processor, causing the processor to:
- receive a network identifier associated with a network-accessible computer system/asset of an organization;
- predict whether a domain is owned by the organization, the prediction returning a numeric ownership guess score, by:
- generating a domain record comprising a data record of domain attributes that is a representation of a public domain registration record for the domain,
- comparing attributes of the domain record with attributes of domain records for which ownership was already decided, including domain records previously flagged as related to the organization and domain records previously flagged as not related to the organization,
- increasing the numeric ownership guess score when one or more of the compared attributes of the domain record have values that match corresponding attributes of one or more domain records previously flagged as related to the organization, and
- decreasing the numeric ownership guess score when one or more of the compared attributes of the domain record have values that match corresponding attributes of one or more domain records previously flagged as not related to the organization;
- access, via a network, the network-accessible computer system/asset and a plurality of related network-accessible computer systems/assets, by
- sending, via a network interface to the network, at least one message to each of the network-accessible computer system/asset and the plurality of related network-accessible computer systems/assets to establish communication,
- wherein the at least one message includes one or more inquiries to determine a communication protocol used by each of the network-accessible computer system/asset and the plurality of related network-accessible computer systems/assets,
- receiving, from each of the network-accessible computer system/asset and the plurality of related network-accessible computer systems/assets, one or more responses to the one or more inquiries, the one or more responses providing information usable to select communication methods,
- transmitting, via the network interface to the network, one or more protocol-specific requests to each of the network-accessible computer systems/asset and the plurality of related network-accessible computer systems/assets, based on the information usable to select communication methods, and
- automatically receiving one or more responses comprising one or more of the following:
- HTTP headers, HTML, JavaScript, cookies, DNS records, and encryption certificates and configurations;
- determine indicia of content features/characteristics for each of the network-accessible computer system/asset and the plurality of related network-accessible computer systems/assets, by analyzing each of the one or more responses using one or more of the following:
- machine learning models, regular expressions, text string matching, natural-language understanding, image processing, and text analysis;
- determine indicia of security features/characteristics of each of the network-accessible computer system/asset and the plurality of related network-accessible computer systems/assets, including detecting one or more of the following:
- encryption, login field, captcha, security feature code, security-related keywords, security feature configurations, password field, security question, user authentication, secure cookies, two-factor authentication, RSA fraud protection, software bot detection, and secure connection protocols;
- determine network proximity between respective ones of the network-accessible computer system/asset and the plurality of related network-accessible computer systems/assets;
- and
- infer a value at risk for each of the network-accessible computer system/asset and the plurality of related network-accessible computer systems/assets based on, for a respective network-accessible computer system/asset, the indicia of content features/characteristics and the indicia of security features/characteristics, and based on network proximity to other network-accessible computer systems/assets with at least one of similar indicia of content features/characteristics, similar indicia of security features/characteristics, and similar values at risk.