ThreatOrigin

Mind the (security) gap

See which malicious requests your security controls miss. ThreatOrigin passively analyzes your DNS logs, then runs controlled tests against your firewall, proxy and DNS protection. So you can measure exactly what ThreatOrigin adds to your security.

How we find your security gaps

ThreatOrigin reads your DNS logs, sends a controlled test request for each malicious domain it finds and shows what your firewall lets through.

  1. 01
    Detects the threat

    Passively reads local DNS logs and spots malicious domains.

0Tests
0Blocked by firewall
0Passed through firewall

25% passed the firewall. ThreatOrigin DNS provides an additional blocking layer for these malicious domains.

Firewall test demo · Example domains · No real traffic or customer results

Multiple defences introduce blind spots

Firewalls, proxies and DNS protection each guard a different layer. Their complexity, integrations and configuration drift leave hidden gaps that attackers can use.

Every security product reports what it blocks. None can report what it misses. Security Gap measures exactly that.

Three tests, every layer

For each malicious domain it finds in your DNS logs, Security Gap simulates a connection in three ways.

FIREWALL TEST

Can it get past your gateway?

Tries a direct connection to the malicious domain through your firewall and checks whether it gets through.

PROXY TEST

Does your proxy stop it?

Sends an HTTP request through your proxy and checks whether its block page comes back or the request reaches our test server.

DNS TEST

Does your DNS protection answer?

Queries your DNS server for the domain and checks whether it is blocked or resolves to the domain's real address.

Every gap in one report

See how much malicious traffic got past each layer, and which domains, users and devices were involved.

Security Gap report summarySample report
18%82%
  • Passed all tested controls
  • Stopped by at least one control
Gap by control

Share of tested requests each control let through. The firewall gap is what the simulation above measures.

  • Firewall gap24%
  • Proxy gap22%
  • DNS protection gap31%
DomainCategoryUserHostFirewallProxyDNSResult
qjcycc.exampleDGA domainj.smithCTO-MacBookPassedPassedPassedGap confirmed
verify-login.examplePhishinga.bakerSales-PC1PassedBlockedPassedBlocked by proxy
zzgg123.exampleMalwared.leeDev-MacPassedPassedPassedGap confirmed
cdn-update.exampleMalwaret.kayaFinance-PCBlockedBlockedPassedBlocked by firewall
account-alert.examplePhishingj.olsenHR-LaptopPassedPassedBlockedBlocked by DNS protection

Illustrative data · Example domains and users · Gap confirmed = passed all tested controls

A data-driven way to optimise your defences

01

Measure what gets through

A quantitative view of the malicious traffic your current controls missed.

02

Prioritise the right fixes

Put resources into the layer with the biggest gap, tested against real threats.

03

Get more from what you have

Fine-tune and complement your current stack instead of replacing it.

There's more to discover !

Sensei

Hey, I'm Sensei

I can walk you through everything about Security Gap. What's on your mind?

ThreatOrigin

Find the Origin Behind Every Threat

©️ ThreatOrigin, 2026. All Rights Reserved