Vellitas maps public-facing digital certificates and enriches them with network, geospatial, and configuration context, so security teams can discover forgotten assets, anomalies, and domain abuse, then act from a clear remediation report.
Patented digital certificate securitySecurity teams harden, patch, and test servers from the inside. That work is essential, but it begins with systems the organization already knows. Forgotten servers, test systems, weak cipher suites, expired certificates, and lookalike domains can remain outside the picture.
Harden. Patch. Test known systems.
Observe public exposure. Verify external defects.
Vellitas complements internal security by assessing the public attack surface the way an external observer sees it.
Vellitas turns public certificate evidence into a focused security assessment and a practical remediation report.
Clear product boundaries
Vellitas separates operating capabilities from planned product work so security buyers can evaluate the service on evidence—not promises.
The Vellitas difference
Asset discovery is only the beginning. Vellitas is designed to preserve the evidence behind a conclusion, show how an identity changes across infrastructure, compare the observation with customer policy, and verify that corrective work actually closed the exposure.
The new collection foundation retains the presented certificate chain with certificate fingerprints, SPKI/public-key identifiers, serial numbers, SANs, issuers, validity, key details, and signature algorithms. Production retention, trust-bundle, and restore controls remain release requirements before this becomes a continuous customer service.
Record the TLS handshake and use bounded follow-up checks to identify accepted protocol versions, cipher groups, chain and hostname failures, and downgrade exposure without turning an assessment into an intrusive application scan.
Correlate certificate fingerprints and public-key reuse across IP addresses, ASNs, providers, and geographies, then preserve first-seen, last-seen, renewal lineage, and infrastructure movement for investigation.
Validate signed log catalogs and tree heads, verify append-only Merkle consistency, authenticate static data tiles, and retain content-addressed issuer evidence before CT observations become customer-facing alerts.
Compare observed issuers, networks, providers, countries, protocols, and lifetimes with approved expectations. Label each result as observed fact, deterministic rule, statistical anomaly, model inference, or recommendation—with evidence and version.
Deliver certificate-specific corrective work and outside-in retesting today. Add reviewed, versioned scripts with preview, approval, rollback guidance, recorded output, and post-change verification as controlled automation is productized.
Methodology
Vellitas observes the evidence an internet-facing service intentionally presents to a client. The assessment is designed to be narrow, repeatable, and efficient.
Certificate chain, subject and SANs, issuer, validity, fingerprints, public-key and signature characteristics, TLS versions and cipher support, chain completeness, revocation signals, DNS and reverse DNS, IP/network owner, observed location, and changes across time.
A full baseline at onboarding; daily review of changed or newly discovered endpoints; a weekly portfolio reassessment; monthly reporting; quarterly scope confirmation; and an on-demand retest after remediation. Contracted service levels control notification timing.
Confirmed findings are reproduced directly. High confidence combines direct evidence with corroborating context. Moderate confidence identifies a real signal with unresolved ownership or attribution. Low-confidence candidates are held for validation rather than presented as remediation work.
No credentials, private keys, user accounts, application databases, encrypted payloads, or internal networks are accessed unless a customer separately and explicitly authorizes a defined test. Vellitas does not exploit defects, guess passwords, or perform availability testing.
Responsible scanning
Vellitas makes rate-limited connections, captures only the technical evidence required for the assessment, closes the connection, retries conservatively, and pauses when a service shows signs of stress. It does not collect page content as part of the certificate assessment.
Read data and scanning practices
BlueVellitas assessment
GreenPass
YellowCaution
RedImmediate actionThird-party exposure
A supplier does not have to store your data to create risk. Remote access, trusted software, embedded code, identity services, and connected infrastructure can turn a weakness at one organization into an attack path into another.
A U.S. Senate staff analysis reported that attackers obtained credentials from a small HVAC contractor and used vendor access to enter Target's environment.
The UK regulator found that malicious code inserted into a third-party chatbot could capture customer and payment information from Ticketmaster pages.
Attackers exploited management software used by service providers, ultimately affecting nearly 1,500 downstream organizations, including small businesses.
Vellitas is not a one-time report. The service establishes the external baseline, develops the remediation plan, helps complete the work, verifies closure, and keeps watching for changes to the security profile.
Vellitas consultants can perform the remediation or work alongside the customer's security, IT, and technology partners.
View an illustrative reportEstablish scope, preserve observed evidence, and prioritize confirmed defects.
Define ownership, corrective work, validation steps, sequencing, and change controls.
Vellitas can execute the plan or collaborate with the client's technology group.
Roadmap scripts are reviewed, versioned, customer-approved, and dry-run before execution.
Reobserve the endpoint, document closure, monitor change, and notify the customer with suggested action.
Vellitas technology links information inside a digital certificate with external network, geospatial, configuration, and historical context. The patent family covers methods for identifying vulnerable certificates across the public internet.
Systems and Methods for Digital Certificate Security
Leadership
Vellitas brings together distributed leadership in security invention, enterprise operations, product architecture, AI, and customer delivery.
CEO · Cofounder
Spencer is a global operations and technology executive with experience building scalable teams and translating complex systems into durable customer and business outcomes. He is an inventor on Vellitas's digital certificate security patents.
LinkedIn profileCOO · Cofounder
Seth is a global customer experience and technology leader known for guiding cross-functional teams across sales engineering, product, engineering, and customer operations. He is a co-inventor on Vellitas's certificate security patents.
LinkedIn profileChief Product & Technology Officer
Fraser is an enterprise technology architect and AI product leader with deep experience in metadata, information governance, and large-scale digital transformation. He has designed platforms and led complex content and data programs for Adobe and Canadian government organizations.
LinkedIn profileTell us about the domains or certificate concerns you want to understand. We will respond with a practical next step for an outside-in assessment.
We use these details only to respond to your request. See our privacy notice.
