Check new HubSpot companies for internet security exposure

Every weekday at 8am, run an external security posture check on the companies that were just added to my HubSpot CRM, so my team walks into vendor and customer conversations already knowing their exposure. Use a cron trigger for this rather than reacting to each new company, because scanning is credit metered and rate limited, and a daily batch is the safer shape.

Start with HubSpot Search Companies to find companies created in the last 24 hours. Only work the ones that have a domain set, and skip any without one rather than guessing a domain from the company name, since a guess would produce findings about somebody else's infrastructure.

For each domain, use Shodan Get Domain Info to pull the subdomains and DNS records Shodan has observed. Then use Shodan Search Hosts to find the hosts tied to that organization, making use of filters such as org for the company name, net for known IP ranges, and SSL certificate matching, which is what surfaces cloud hosted assets that do not sit on an obvious range. From those results, pick out the notable hosts and drill into them with Shodan Get Host Information for the full picture of open ports, service banners, and software versions.

Pace the Shodan calls. The API allows about one request per second and searches consume query credits, so work through the companies one at a time, limit the hosts you drill into to the genuinely interesting ones rather than everything returned, and if credits run out, finish the companies already covered instead of failing the whole run.

Write the findings back onto the company record with HubSpot Create Note, associated to that company. Cover four things: the internet facing footprint, meaning roughly how many hosts and subdomains exist and where they are hosted; exposed remote access or database services, such as RDP, SSH, MongoDB, or Elasticsearch reachable from the internet on default ports; outdated software versions visible in the service banners; and certificates that have already expired or expire soon.

Keep the note measured and evidence based rather than alarmist, because it lives on a customer facing record that account managers and sometimes the customers themselves will read. State what was observed, when it was observed, and the specific host or subdomain it was observed on. Do not speculate about whether a finding is exploitable, do not invent a severity score, and do not use words like critical or breach except when describing a specific concrete finding. If nothing notable turned up, say so plainly in a sentence or two rather than padding the note.

Only send a Slack message when the check turns up something genuinely critical, meaning an open or unauthenticated database, or an exposed admin panel. In that case use the Slack Bot Send a Message action to post to the security channel with the company name, the specific finding, the host or subdomain it was found on, and a link to the HubSpot record. Everything else stays in the note. A quiet channel is the goal, so do not post per company summaries and do not post when nothing was found.

Handle the empty cases cleanly. If no companies were created in the last 24 hours, or none of them have a domain, finish without writing anything. If Shodan simply has no data for a domain, still write a short note recording that nothing was observed, because for a vendor review that absence is itself useful to know.