Compare
Fromenance vs brand protection and takedown vendors
Brand protection vendors are good at what they do: they find impersonation infrastructure from the outside and get it taken down. Fromenance is communication provenance, which starts from the other end: the customer holding the lure gets an answer from you, and the lure itself becomes intelligence. Different sensor, different moment in the attack, and institutions run both and connect them.
Side by side
What each one does
| Question | Brand protection and takedown | Fromenance |
|---|---|---|
| What is the sensor? | Crawlers, domain registration feeds, certificate transparency logs, app stores, social platforms, and sometimes your abuse mailbox. | The customer who just received the lure. Every submission is a real impersonation attempt that was convincing enough for its target to pause and ask. |
| When does it see an attack? | When the infrastructure becomes visible: a domain is registered, a certificate is issued, a page gets crawled. Sometimes before mail goes out, sometimes after. | When the first customer forwards it, which is usually inside the first hour of a campaign reaching inboxes. We do not see infrastructure that never reaches a customer. |
| What does the customer get? | Nothing directly. The customer is not part of the workflow. | A definitive Verified, Not verified, or Known fraud reply from your domain, in seconds, with a next step. |
| What does it do about the attack? | Files takedowns with registrars, hosts, and platforms, with a lag measured in hours to days depending on who is on the other end. | Answers the customer, pulls out the indicators, adds confirmed lures to your fraud list so the next customer gets Known fraud in seconds, and exports the indicators to your takedown vendor, gateway, and SIEM. |
| Does it know what you actually sent? | No.No. Brand protection works from the outside in and has no record of your legitimate communications. | Yes.Yes. The registry is the authoritative positive set. That is what makes Verified possible at all. |
| Which channels? | Web, domains, social, app stores, marketplaces. Broad, and focused on infrastructure. | Email in v1, plus the indicators from lures across any channel a customer forwards. SMS, documents, and voice are on the roadmap. |
| How do they work together? | Receives indicators and campaign exports from us through signed webhooks and STIX 2.1, and gets the earliest possible signal: the lure itself. | Uses your takedown vendor as the enforcement arm. We do not file takedowns. |
The gap
A different sensor
Monitoring and takedown platforms earn their keep, and we export to them. The gap is the person on the other end of the message.
Outside in
Monitoring works from public signals: new domains that resemble yours, certificates, cloned pages, fake apps. It finds infrastructure. It cannot tell your customer whether the message in their inbox is yours, and it only sees the campaigns whose infrastructure a crawler can reach.
Inside out
We start from what you sent. A submission that does not match is, by construction, a message that reached a real customer and claimed to be you. Its domains, links, phone numbers, and QR codes are pulled out in seconds, and you can push them to your takedown vendor through a signed webhook or a STIX export. The vendor gets the lure before their crawler would have found the page.
Both
Why you want both
Keep your takedown vendor; they are the enforcement arm. Add us as the answer your customer gets and the earliest sensor you have, and connect the two with the indicator.new and verdict.created webhooks. On the roadmap, a confirmed campaign exports to your takedown vendor with one click.
Start with one stream and a 60 to 90 day pilot.
Pick your fraud alerts or your transaction alerts, the messages your customers already squint at. At the end you get a written report: how many people asked, what they were told, which campaigns turned up, and what your existing feeds missed.