Screen new HubSpot companies for security risk with Censys
Every morning we scan each new company's domain, rate its external security exposure, log the findings to the CRM record, and alert your team when a vendor looks risky.
Censys
HubSpot
Slack BotOperationsSalesResearch & MonitoringNotifications & AlertsAI ReportsEvery morning, on a cron schedule, automatically screen the companies that were just added to our HubSpot CRM for external security risk, and flag the risky ones to our team. This runs once each morning.
Start by using HubSpot Search Companies to find every company whose create date falls within the last 24 hours. Filter on the createdate property (greater than or equal to 24 hours ago) and sort by newest. For each company returned, read its website or domain property, and skip any company that has no website domain.
For each company that has a domain, use Censys to assess that vendor's external security posture. First call Censys 'Get DNS Resolution Records for a Name' on the company's domain to resolve it to its hosts, and collect the IP addresses it currently resolves to (the A and AAAA records).
Then, for each resolved IP address, call Censys 'Get Host Enrichment' to pull that host's details: exposed ports and services, any risky or administrative services (for example exposed databases, RDP, SSH, admin panels, or unauthenticated services), and its TLS and certificate posture (expired, self-signed, or otherwise weak certificates).
Important nuance: both the Censys 'Get DNS Resolution Records for a Name' and 'Get Host Enrichment' calls require the Organization ID to be set on the Censys connection. Without it they return a 422 error, so make sure the connection includes the Organization ID before relying on this workflow.
Based on the enrichment findings, write a short vendor-risk summary for the company: a clear low, medium, or high risk rating followed by the notable findings that justify it (exposed ports and services, risky services, weak or expired TLS, and the hosts involved). Keep it concise and readable, a few sentences plus the key findings, and include the date of the scan.
Save that summary back to the company's HubSpot record using HubSpot Create Note, associated with that company, so the assessment lives on the company timeline. Include the risk rating in the note.
Finally, only when the rating is medium or high, post a Slack alert to our security or procurement channel using Slack's Send a Message action. The alert should name the company, its domain, the risk rating, and the top findings, and reference the HubSpot company record. Do not post anything to Slack for companies rated low.
Make the risk threshold that triggers a Slack alert user-editable (default: alert on medium or high), make the target Slack channel user-editable, and make the lookback window user-editable (default: the last 24 hours). If you prefer near-real-time screening, this can also be driven by a HubSpot new-company webhook so each company is assessed the moment it is created instead of once a day.
Example output
What does this prompt do?
- Finds every company added to your HubSpot CRM in the last day that has a website.
- Checks each company's public internet footprint for exposed services, risky ports, and weak security certificates using Censys.
- Writes a short low, medium, or high risk summary and saves it right on the HubSpot company record.
- Sends a Slack alert to your security or procurement channel only when a company looks medium or high risk.
What do I need to use this?
- A HubSpot account where new companies are created.
- A Censys account, including its Organization ID on the connection (the security lookups will not run without it).
- A Slack workspace and the channel where you want risk alerts posted.
How can I customize it?
- Change which risk levels trigger a Slack alert, for example only high risk, or both medium and high.
- Pick the Slack channel that receives the alerts, such as your security or procurement channel.
- Adjust how far back it looks for new companies, or run it the moment a company is added instead of once a day.
FAQs
What does the security check actually look at?
Will it flag every new company?
Where do the results end up?
Do I need anything special on my Censys account?
Can it run automatically when a company is added instead of every morning?
Related templates
When someone leaves, we check which shared passwords they used in their final months and post a ranked rotation list to your security channel.
Every Monday, check every S3 bucket for public exposure, missing encryption and weak backup settings, then get the risks ranked in Slack.
Twice every weekday, the conversations from your social inbox land on the right HubSpot contact timelines, with a Slack recap for sales.
Every weekday at 7am, sign in to the tender portals you track, filter new notices against your bid criteria, and open a deal for the ones worth chasing.
Every morning, find the addresses that hard bounced or filed a spam complaint, update the matching HubSpot contacts, and post a short Slack recap.
Every weekday at 4pm, spot the threads that went quiet, stage a ready-to-send nudge in your mailbox, and get a ranked Slack recap.
Vet every new vendor before anyone works with them.
Turn each new company in your CRM into an automatic external security check, logged to the record and flagged to your team when it matters.