There is no scripted product tour against a sample tenant. You give us one apex domain, a ShadowMap engineer maps it while you watch, and we walk through what came back — including the parts that turn out to be dull. Thirty minutes, and nothing to prepare at your end.
Before · During · After
Every step exists because the one before it happened, so this is the order it runs in rather than a menu of things that might come up.
Before · when you book
That is the entire preparation. We begin attributing assets to it before we meet, so the thirty minutes goes on reading findings rather than watching a scan bar. Send subsidiary and brand names at the same time if you want them in scope.
First ten minutes
Not a recorded walkthrough and not a sample tenant. You watch your own domains, subdomains, reachable services and exposed panels resolve, alongside the evidence that ties each one to your organisation rather than to somebody with a similar name.
Next fifteen
The assets we can attribute to you, credentials of yours already circulating in breach and stealer data, code and secrets sitting in public places, and look-alike domains wearing your brand. Where a finding is thin we say so on the call — an outside-in first pass has limits, and a demo that hides them is a demo you resent in month three.
Last five
ShadowMap is priced by asset-surface size and module footprint rather than analyst seats, so the price depends on what we just found. We ask about registered brands, vendor portfolio size, and whether you want to operate the console yourself or have our analysts run it alongside your team.
After · within one business day
You leave with a draft of your attributed inventory and a written pricing letter, whether or not you take it further. Neither is redacted, and neither is contingent on booking a second call.
The variables behind that number are published in full on the pricing page, and how the platform arrives at a finding in the first place is on how it works. Neither is homework — read them afterwards if you want to check our arithmetic.
Preparation
No access to grant, no credentials to issue, no environment to prepare. Only the first row is something we genuinely cannot start without.
| What to bring | Why we ask for it | Needed? |
|---|---|---|
| Your apex domain | Everything else is discovered from it — subdomains, hosts, reachable services, exposed panels and the cloud footprint attached to them. | Required |
| Just the apex: acmecorp.com, not https:// and not www. One is enough to start; more than one is fine. | ||
| Subsidiaries, acquisitions and trading names | Inherited estates are where an outside-in map usually finds the things nobody is watching, because nobody built them and nobody was handed them. | Recommended |
| Mid-acquisition and unable to name the target? Say so and we will scope around it rather than ask you to disclose it. | ||
| The brands you have registered | Brand coverage is counted per registered brand, so this is both what we watch and part of what sets your price. | Recommended |
| Whoever owns remediation | The back half of the call is what you would do about what we found, and that conversation is better with the person who would have to do it in the room. | Optional |
What to have ready before a ShadowMap demo
Your apex domain
Just the apex: acmecorp.com, not https:// and not www. One is enough to start; more than one is fine.
Subsidiaries, acquisitions and trading names
Mid-acquisition and unable to name the target? Say so and we will scope around it rather than ask you to disclose it.
The brands you have registered
Whoever owns remediation
Deliberately excluded
If a call is not how you buy
Plenty of security teams want to see the output before they put a vendor in their diary, which is a reasonable position. The Exposure Snapshot is the same product run against the same apex domain — the findings are written down instead of narrated.
Both routes end in the same place if you want them to. Nothing about taking the snapshot first makes the call redundant, and nothing about taking the call commits you to anything beyond reading the letter that follows it.
Thirty minutes with a ShadowMap engineer, your external estate mapped while you watch, and a written price based on what we actually found rather than on a seat count.