Skip to main content

Onboarding clients

If you manage the attack surface of several organizations, for instance as a managed security service provider or a consultant, Red Kite lets you keep each client's data separate, and give each client access to its own data only.

1. Create one project per client​

A project holds all the resources of a target, and resources never cross projects. Create one project per client in Management > Projects, with the client's name and logo.

Use the project's notes to keep useful information at hand, such as the contacts, the scope agreed with the client or the contract dates.

tip

For a large client with several subsidiaries, you can also create one project per subsidiary. Name them consistently, such as ACME - Retail and ACME - Bank, so that the project: filter can match them all with project:ACME*.

2. Add the client's seed data​

Add the domains, IPs and IP ranges provided by the client, and only those. See My first scan.

Stick to the scope agreed with the client: Red Kite follows the leads it finds, so block the resources that are out of scope as you find them.

3. Keep the client's configuration separate​

Some configuration can be set for a single project:

  • Secrets: if a client provides credentials, for instance an API key for one of their tools, create the secret for their project only. A project secret overrides a global secret with the same name. See Secrets.
  • Subscriptions: a subscription can apply to all projects or to a single one, for instance to scan one client more often, or to run a job that only applies to them. See Subscriptions.

4. Give the client access​

To let a client log in and see their own data:

  1. In Management > Groups, create a group for the client from the project read-only template, or project contributor if they should be able to update their data.
  2. Select Permissions apply on selected projects and add the client's project.
  3. Invite the client's users in that group.

To give a client a quick look without creating accounts, share the project with a link instead.

See Managing roles and permissions for the details.

5. Report to the client​

  • Filter the intel on the client's project, for instance project:"ACME" is:open, to review their issues with them.
  • Use the timeline of each intel to keep a history of the discussions with the client.
  • Export the resources or a custom table to build your reports.