Catching a defacement before anyone else does

Most organisations find out their site has been defaced because somebody else tells them

The problem

Nobody watches a website continuously. Pages that matter get checked at launch and then left, and the ones most likely to be targeted are often the ones nobody visits internally: a campaign microsite, a subsidiary page, a portal that only opens during an application window. A defacement can sit there for hours. The first notification usually arrives from outside, as a screenshot on social media, a call from a journalist, or a customer asking whether the organisation has been hacked. By then the conversation is about the incident and the response at the same time.

The usual answer

The obvious fix is to watch for changes, and it fails for a predictable reason. Websites change constantly. Content is published, banners rotate, session tokens differ, timestamps move, third-party widgets load different content on every request. A monitor that alerts on any difference produces so many alerts that people stop reading them, and the one that mattered arrives in the same inbox as forty that did not.

How we approach it

SentryPage captures each registered page on an interval as short as five minutes and compares the capture against the one before it. Where something has changed, the change is put through two detection engines rather than sent straight out as an alert. The Attack Signature Engine™ runs it against a database of analysed defacement patterns, looking for the signatures attackers actually leave behind, including profanities across ten languages and irregular spellings such as "H4ck3d By" that plain keyword matching misses. An email alert goes out when the change looks like a defacement, and every alert is kept in a history table.

What changes

The alerts stay worth opening. A five-minute detection window means the response starts while the page is still recoverable and before the public sees it, and the team is not spending its attention dismissing normal content updates to find the one that is not.