Security operations and response
Digital risk protection
Digital risk protection (DRP) is the practice of monitoring the public internet for threats to an organisation's brand, people and customers, and acting to remove or contain them, across web, email, social, mobile and marketplace channels.
What it covers
DRP looks outward, at things the organisation does not control.
- Impersonation: lookalike domains, cloned sites, fake social accounts and apps.
- Phishing and fraud aimed at customers and employees.
- Exposed data: credentials, documents or keys posted where they should not be.
- Executive and VIP targeting.
- Counterfeit and grey-market sales.
How it differs from adjacent disciplines
Threat intelligence describes the threat landscape; DRP acts on the specific instances that touch one organisation. Attack-surface management inventories the organisation's own assets; DRP watches for assets that pretend to be the organisation's. Security awareness trains people; DRP removes the things they would otherwise be trained to spot.
Software, service or both
The detection side is largely automatable. The enforcement side, filing with registrars, hosts and platforms and following up, is a mixture of automation and people, and the split between a platform the team runs and a managed service depends on the team's capacity and the volume of abuse. Whichever model is chosen, the questions to ask are the same: what is watched, how quickly a finding becomes a report, what evidence is attached, and what resolved means.
Related terms
Sources
External guidance is general. Adapt it to your legal, regulatory and operational requirements.