Screen new HubSpot companies for security risk with Censys

Every morning, on a cron schedule, automatically screen the companies that were just added to our HubSpot CRM for external security risk, and flag the risky ones to our team. This runs once each morning.

Start by using HubSpot Search Companies to find every company whose create date falls within the last 24 hours. Filter on the createdate property (greater than or equal to 24 hours ago) and sort by newest. For each company returned, read its website or domain property, and skip any company that has no website domain.

For each company that has a domain, use Censys to assess that vendor's external security posture. First call Censys 'Get DNS Resolution Records for a Name' on the company's domain to resolve it to its hosts, and collect the IP addresses it currently resolves to (the A and AAAA records).

Then, for each resolved IP address, call Censys 'Get Host Enrichment' to pull that host's details: exposed ports and services, any risky or administrative services (for example exposed databases, RDP, SSH, admin panels, or unauthenticated services), and its TLS and certificate posture (expired, self-signed, or otherwise weak certificates).

Important nuance: both the Censys 'Get DNS Resolution Records for a Name' and 'Get Host Enrichment' calls require the Organization ID to be set on the Censys connection. Without it they return a 422 error, so make sure the connection includes the Organization ID before relying on this workflow.

Based on the enrichment findings, write a short vendor-risk summary for the company: a clear low, medium, or high risk rating followed by the notable findings that justify it (exposed ports and services, risky services, weak or expired TLS, and the hosts involved). Keep it concise and readable, a few sentences plus the key findings, and include the date of the scan.

Save that summary back to the company's HubSpot record using HubSpot Create Note, associated with that company, so the assessment lives on the company timeline. Include the risk rating in the note.

Finally, only when the rating is medium or high, post a Slack alert to our security or procurement channel using Slack's Send a Message action. The alert should name the company, its domain, the risk rating, and the top findings, and reference the HubSpot company record. Do not post anything to Slack for companies rated low.

Make the risk threshold that triggers a Slack alert user-editable (default: alert on medium or high), make the target Slack channel user-editable, and make the lookback window user-editable (default: the last 24 hours). If you prefer near-real-time screening, this can also be driven by a HubSpot new-company webhook so each company is assessed the moment it is created instead of once a day.