Executive Summary

SecurityTrails (securitytrails.com) is a cyber-intelligence company known for its “Total Internet Inventory” data products – domain, DNS, IP, and historical internet-asset intelligence delivered through APIs, feeds, and web applications.

Our team contributed across several key platform areas over multiple years, including large-scale data pipelines, storage optimization, high-volume APIs, customer-facing applications, and attack surface monitoring capabilities.

Recorded Future announced the acquisition of SecurityTrails on January 4, 2022.

Client Overview (SecurityTrails)

SecurityTrails specializes in domain and IP intelligence, providing current and historical internet-asset data such as DNS and WHOIS history. This information helps organizations perform attack surface discovery, third-party risk analysis, threat hunting, threat intelligence and data enrichment.

Its products are delivered primarily through APIs, enrichment feeds, and web applications used by security teams and analysts.

In January 2022, Recorded Future announced the acquisition of SecurityTrails, with the deal value reported by multiple outlets at approximately $65M.

The Challenges

As SecurityTrails expanded its internet inventory and customer base, the platform encountered the typical scaling challenges of large internet-data systems.

These included:

• ingesting and processing extremely large datasets
• efficiently storing long-term historical data
• maintaining low-latency search and query performance
• exposing capabilities through high-volume APIs and customer-facing tools

At the same time, the platform evolved toward attack surface monitoring and vulnerability intelligence, which introduced additional requirements such as scanning infrastructure, operational controls, risk scoring workflows, and internal tooling.

How We Helped

Our team contributed across multiple product and engineering workstreams.

1. Data Pipeline and Storage Engineering

We worked on improving the ingestion and processing of very large internet-asset datasets.

This included:

• optimizing transformation pipelines for current and historical datasets
• implementing storage and sharding strategies to keep large data volumes queryable while controlling cost and latency
• improving pipeline reliability and observability to reduce operational noise and improve data freshness

2. Scalable API and Search Capabilities

We contributed to improving the platform’s API scalability and performance to support high request volumes.

Key work included:

• optimizing API performance for low-latency intelligence lookups
• supporting more expressive search capabilities, including SQL-like querying
• improving caching, indexing, and data-access patterns for fast domain and DNS intelligence retrieval

3. Web Applications and Reporting UX

We helped evolve customer-facing applications that allow organizations to explore their external internet footprint.

This included:

• expanding the capabilities of the SurfaceBrowser interface
• enabling project-based workflows for tracking assets and changes over time
• supporting visualization and complex reporting experiences for external exposure analysis

4. Attack Surface Monitoring and Vulnerability Management

As the platform expanded toward attack surface intelligence, we contributed to backend and operational components that support scanning and risk workflows.

This included:

• automation components for scanning infrastructure
• operational controls for scan volume and execution behavior
• internal tooling to help manage scanning operations, data flows, and support processes

5. Product Prototyping and Validation

We also helped validate new product concepts through rapid prototyping, market research, and competitive analysis before full implementation.

6. Customer Support Contributions

Our team assisted customers using the platform by troubleshooting issues, answering usage questions, and providing feedback to product and engineering teams to improve the overall experience.

7. Support for Attack Surface Intelligence Customers

We also provided high-level assistance for customers using attack surface intelligence capabilities, including onboarding support, configuration guidance, and recommendations on best-practice workflows.

Impact

Because the engagement spanned multiple platform layers, the impact was visible both internally and externally.

Key outcomes included:

• faster and more reliable access to large-scale internet intelligence data
• improved API performance and capacity for high-volume integrations
• more intuitive workflows for discovering and monitoring internet assets
• better operational control over scanning and vulnerability workloads

These improvements supported the continued growth of the platform while helping customers more efficiently investigate and understand their external attack surface.

Where precise metrics are not publicly available, these outcomes reflect typical improvements for large internet-inventory platforms, including reduced latency, improved throughput, increased reliability, and faster investigation workflows.

Timeline Snapshot

Major product initiatives evolved over several years: