A commissioned forensic investigation of a single vendor: what they claim, and what their code actually does. Court-ready evidence, delivered by an analyst in 72 hours.
Before you sign. Before you renew. Before it becomes someone else's finding.
Anonymized findings from actual engagements. The left column is the vendor's published claim. The right column is what the scanner observed at runtime.
“No tracking before consent”
7 network calls initiated before consent banner rendered
“Data never leaves the EU”
PII transmitted to 3 US-based endpoints within 150ms
“No third-party sharing”
Browser sync with 14 undisclosed processors including ad networks
“Respects user opt-out”
Tracking continues post-rejection via fingerprinting fallback
Source: BLACKOUT forensic engagements · anonymized
A defeat device is code built to detect compliance auditors, legal discovery tools, and researchers — then behave differently for them than for real users.
/headless|phantom|selenium|webdriver|puppeteer|playwright|monitor|checker|validator|analyzer/iWe documented 42 such patterns in a single vendor. If your audit tools didn't trigger these flags, you never saw what the vendor actually does.
This isn't theoretical. The same methodology behind every published BLACKOUT investigation runs every commissioned engagement.
You're 2 weeks from signing a $200K/year contract. The vendor's security questionnaire came back clean. Their SOC 2 looks fine. But something feels off.
Know what you're actually buying before the ink dries.
Counsel needs to know exactly what a data processor did with PII — documented in the browser, with chain of custody, in a form that survives scrutiny.
Evidence built to hold up.
The target looks clean on paper. But their website runs 47 third-party scripts you've never heard of. What's in their GTM layer transfers on close.
Know the risk before you acquire it.
Your team flagged a vendor but can't explain why. The vendor claims they're 'GDPR compliant' and 'privacy-first.' You need technical proof, not marketing claims.
Answers your tools can't produce on their own.
You're not buying a report. You're commissioning intelligence work — a named analyst, a defined scope, and a deliverable built for the decision in front of you.
Vendor, your use case, what you're trying to learn. We confirm scope and send a quote within 4 hours.
Full forensic pass: scripts, cookies, network behavior, consent handling, data flows, third-party connections, defeat-device detection, claims vs. observed.
Complete evidence package within 72 hours of scope confirmation. HAR files, deobfuscated code, network captures, screenshots, chain-of-custody documentation.
30-minute readout call plus 14 days of follow-up support, included in every engagement.
A named analyst on your case, with a direct channel for the length of the engagement.
What the vendor does, mapped across signal integrity, data exposure, compliance risk, and attack surface.
Where data actually goes. Every endpoint, every third party, every downstream processor.
Disclosed vs. observed processors. Who they say receives data vs. who the wire shows.
What's inside the blob URLs and minified scripts. We reverse it and document the behavior.
Does the vendor behave differently when observed? We test for audit evasion your tools can't see.
Formatted for the desk it lands on — leadership, security, legal, or the negotiation.
2-3 page summary for leadership. Key findings, risk assessment, recommended actions.
Full findings with evidence. Code analysis, network behavior, consent audit, defeat-device documentation.
Detection patterns your security team can import directly into their tooling and block lists.
Timestamped network captures. Full HTTP traffic for forensic replay and verification.
Timestamped visual evidence. Consent states, network panels, behavior documentation.
Scope confirmed within 4 hours of your request. Delivery within 72 hours of scope confirmation. Multiple vendors scope as one engagement, quoted accordingly. 24-hour rush available, priced in the quote.
A law firm runs this same work at $15,000–$30,000. The vendor contract you're evaluating costs more per month.
Because engagements vary. A vendor with one script and three endpoints is not a vendor with an authenticated platform, forty subprocessors, and a defeat device. You tell us the vendor and the question; we quote the scope within 4 hours. The floor is $7,500.
That's the point. We investigate any vendor — profiled before or not. You're commissioning original intelligence, not buying a cached report.
From the outside, the way the vendor's code actually meets the world: controlled browser sessions, public endpoints, observable behavior. No agents, no credentials, no access to your infrastructure.
72 hours from scope confirmation. A 24-hour rush is available and priced in the quote.
The evidence package is built to withstand scrutiny: chain of custody documented, timestamps verified, methodology reproducible. What it supports legally is your counsel's determination — we deliver the evidence, not the conclusion.
We specifically test for audit evasion. If a vendor behaves differently when it detects observation, we document both behaviors. Most compliance tools can't see this. It's the signature of our methodology.
Then RECON is the wrong tier. DOSSIER opens the full 601-vendor corpus at analyst depth. COVERAGE points the apparatus at your own properties continuously. RECON is for the vendor that needs an answer this week.
Need the whole corpus instead? That's DOSSIER. Need it pointed at your own stack, continuously? That's COVERAGE.
See the tiers