# Check new HubSpot companies for internet security exposure

> Every weekday we check what the companies added to your CRM yesterday expose to the internet, and leave a short factual brief on each record.

- Workflow type: agent
- Services: Shodan, HubSpot, Slack Bot
- Categories: Sales, Operations
- Published: 2026-08-09

## What it does

- Each weekday morning, finds the companies added to your HubSpot in the last day and picks out the ones that have a website domain on file.
- Looks up what each of those companies exposes to the public internet: their known subdomains, the servers tied to their name, and the services running on them.
- Writes a short, factual note on the company record covering their internet footprint, any remote access or database services left open, out of date software, and certificates that have expired or are about to.
- Stays quiet unless something genuinely serious turns up, such as an open database or an exposed admin login, in which case your security channel gets a Slack message.

## What you'll need

- A HubSpot account where new companies usually have a website domain filled in
- A Shodan account with search credits available, which the paid plans include
- A Slack workspace and a channel where security alerts should land

## Prompt

Every weekday at 8am, run an external security posture check on the companies that were just added to my HubSpot CRM, so my team walks into vendor and customer conversations already knowing their exposure. Use a cron trigger for this rather than reacting to each new company, because scanning is credit metered and rate limited, and a daily batch is the safer shape.

Start with HubSpot Search Companies to find companies created in the last 24 hours. Only work the ones that have a domain set, and skip any without one rather than guessing a domain from the company name, since a guess would produce findings about somebody else's infrastructure.

For each domain, use Shodan Get Domain Info to pull the subdomains and DNS records Shodan has observed. Then use Shodan Search Hosts to find the hosts tied to that organization, making use of filters such as org for the company name, net for known IP ranges, and SSL certificate matching, which is what surfaces cloud hosted assets that do not sit on an obvious range. From those results, pick out the notable hosts and drill into them with Shodan Get Host Information for the full picture of open ports, service banners, and software versions.

Pace the Shodan calls. The API allows about one request per second and searches consume query credits, so work through the companies one at a time, limit the hosts you drill into to the genuinely interesting ones rather than everything returned, and if credits run out, finish the companies already covered instead of failing the whole run.

Write the findings back onto the company record with HubSpot Create Note, associated to that company. Cover four things: the internet facing footprint, meaning roughly how many hosts and subdomains exist and where they are hosted; exposed remote access or database services, such as RDP, SSH, MongoDB, or Elasticsearch reachable from the internet on default ports; outdated software versions visible in the service banners; and certificates that have already expired or expire soon.

Keep the note measured and evidence based rather than alarmist, because it lives on a customer facing record that account managers and sometimes the customers themselves will read. State what was observed, when it was observed, and the specific host or subdomain it was observed on. Do not speculate about whether a finding is exploitable, do not invent a severity score, and do not use words like critical or breach except when describing a specific concrete finding. If nothing notable turned up, say so plainly in a sentence or two rather than padding the note.

Only send a Slack message when the check turns up something genuinely critical, meaning an open or unauthenticated database, or an exposed admin panel. In that case use the Slack Bot Send a Message action to post to the security channel with the company name, the specific finding, the host or subdomain it was found on, and a link to the HubSpot record. Everything else stays in the note. A quiet channel is the goal, so do not post per company summaries and do not post when nothing was found.

Handle the empty cases cleanly. If no companies were created in the last 24 hours, or none of them have a domain, finish without writing anything. If Shodan simply has no data for a domain, still write a short note recording that nothing was observed, because for a vendor review that absence is itself useful to know.

## How to customize

- Change the timing, so it runs daily, twice a week, or at whatever hour suits your team's morning.
- Change what counts as urgent enough to interrupt Slack, and which channel hears about it.
- Narrow it to the records that matter, for example only new vendors or only accounts above a certain size, instead of every new company.

## FAQ

### Does this scan or attack the companies it looks at?

No. Shodan continuously catalogues what is already publicly visible on the internet, and this workflow only reads what it has already recorded. Nothing is sent to the company's own systems, and they see no traffic from you.

### Will this work on a free HubSpot account?

Yes. Companies and notes are standard parts of the HubSpot CRM on every tier, including the free one, so no paid HubSpot upgrade is needed.

### What happens to companies that have no website on the record?

They are skipped and no note is written. The check needs a real domain to work from, and guessing one from the company name would produce findings about somebody else's servers.

### Who can see the note it writes?

It lives on the company record in HubSpot, so anyone with access to that record can read it, which sometimes includes people in customer facing conversations. That is exactly why the note is written in measured, factual language rather than as a security alarm.

### How many companies can it get through in one run?

Shodan allows roughly one lookup per second and each search draws on your credit balance, so the workflow works through companies steadily rather than all at once. A normal day of new records is comfortable. A large one off import will simply take longer.

Use this prompt in General Input: https://www.generalinput.com/prompts/check-new-hubspot-companies-for-internet-security-exposure