URL Category Data for Security Posture Management
Posture management products read configurations and find risk before an attacker does. Those configurations are full of domains: webhook targets, connected apps, forwarding rules, egress allow lists, sharing settings and DNS records.
A category for each of those domains turns a long settings dump into clear findings. This guide is for product teams building posture tools and the security architects who use them.
Which posture products use category data
Different posture tools look at different layers. All of them meet external domains, and all of them benefit from knowing what those domains are.
SaaS posture
Connected third-party apps, webhooks, mail forwarding, external sharing and allowed domains in SaaS tenants.
Cloud posture
Egress rules, allowed outbound domains, function and container call-outs, and exposed endpoints.
Data posture
Where sensitive data is shared, synced or replicated, including external domains and storage targets.
Exposure management
Attack surface across the company's own domains, subdomains and the third parties they depend on.
Web security posture
Audits of a customer's own filtering policies: are key risk categories actually blocked everywhere?
Where domains hide in configurations
Posture scans already collect these settings. Adding a category to each domain is a small step that changes how findings are ranked.
| Configuration item | Where it lives | What the category reveals |
|---|---|---|
| Mail forwarding and routing rules | SaaS email tenant | Forwarding to personal Email providers or unknown domains |
| Webhook and callback URLs | SaaS apps, CI/CD, chat tools | Data sent to file hosts, paste sites, URL shorteners or brand-new domains |
| Connected third-party apps | Identity provider and SaaS consent records | Publisher domains that are AI tools, parked, or unrelated to the app's claimed purpose |
| External sharing allow lists | File storage and collaboration tenants | Allowed domains that are free personal mail or public storage |
| Egress allow lists | Cloud firewall and proxy rules | Wildcards that open storage, anonymizers or remote access services to workloads |
| Outbound calls in code and functions | Cloud functions, containers, infrastructure code | Hard-coded calls to code hosting, file sharing or unknown domains |
| DNS records of company domains | DNS zones | Subdomains that now point at parked or for-sale pages |
| Web filter policies | Customer's gateway, DNS filter or browser policy | Risk categories left allowed for some groups or locations |
Categories that drive posture findings
A small set of categories produces most high-value findings. The default severity is a starting point that customers can tune.
| Category | Typical finding | Default severity |
|---|---|---|
| Malware / Phishing / Suspicious | A configured destination or connected app publisher is known to be risky | Critical |
| File Sharing/P2P | Webhook, export or egress rule sends data to anonymous file transfer sites | High |
| Cloud Storage / File Hosting | Exports or sync jobs to storage outside the company tenant | High |
| Mailbox forwarding or sharing allowed to personal mail domains | High | |
| AI / LLM Tools | AI apps connected with broad data scopes, or AI destinations in egress rules | Medium |
| VPN / Proxy / Anonymizers | Workload egress allowed to anonymizers | High |
| Remote Access Tools | Remote access services allowed from server segments | Medium |
| URL Shorteners | Callback or redirect URLs that hide the final destination | Medium |
| Parked / For-Sale Domains | Company subdomain or allowed domain now parked or for sale | High |
| Developer Tools / Code Hosting | Runtime code pulled from public repositories | Low |
| Unknown or newly registered | Configured destinations no one can identify | Medium |
Example findings
These are the kind of findings a posture tool can raise once domains carry categories. Each has a clear owner and a clear fix.
Three mailboxes in Finance forward all mail to a free personal email domain.
A project tool posts exports to an anonymous file transfer domain every night.
A connected app whose publisher domain is an AI note-taking tool can read all mail for 40 users.
A marketing subdomain still points at a host that now serves a for-sale page.
A production subnet may reach any domain in the storage category through a broad allow rule.
The web filter policy for one branch leaves VPN / Proxy / Anonymizers allowed.
Category data in posture scores
Executives read posture as a score. Category data makes the parts of that score explainable, because each deduction points to a type of destination.
Illustrative score breakdown
Numbers are examples only. Each bar can open a list of findings grouped by category.
- Weight deductions by category severity, so one forwarding rule to a file host costs more than ten links to news sites.
- Group findings by category in the report so owners see patterns, not one-off items.
- Track the score per category over time to show progress on themes like shadow AI or personal storage.
- Let customers mark specific domains as approved, which removes them from scoring for that tenant only.
- Show the label build date with each finding, so a later label change does not confuse an audit.
Shadow AI as a posture problem
AI tools appear in posture data as connected apps, browser destinations, egress rules and data sharing targets. Seeing them all in one place is a common customer request.
Connected AI apps
Flag consent grants where the publisher domain sits in the AI category, with the scopes granted and the number of users.
AI in egress rules
Spot workloads allowed to call AI services directly, which often means data leaves without review.
AI as a sharing target
Find files shared with AI tool domains or synced to them through integrations.
By AI subcategory
Separate chat assistants, code assistants, meeting tools and media generators, since risk differs by type.
New AI tools
The AI set is updated daily, so new tools show up in findings without waiting for manual catalog work.
AI inventory report
Give governance teams one list of every AI destination seen across apps, cloud and web.
Delivery: batch first, freshness over speed
Posture scans run on a schedule, so the lookup budget is generous. What matters is coverage, consistency between scans and fresh labels for new domains.
Local database
Load the full file from CSV, Parquet or JSON into your scanning backend. Every scan resolves domains without calling out.
Batch API
For lighter deployments, send domains in batches of up to 1,000 per request after each scan. See the API documentation.
Daily deltas
About 300,000 newly registered domains a day, plus rechecks after a week and a month. Apply before the next scan cycle.
| Scan type | Typical rhythm | Data path |
|---|---|---|
| Full tenant scan | Daily or weekly | Local database, batch API for misses |
| Event-driven check (new app consent, new rule) | Minutes after the change | Local database or single API lookup |
| DNS and subdomain sweep | Daily | Local database, updated by deltas |
| Monthly executive report | Monthly | Local database after monthly refresh |
Auditing a customer's own web filter policy
Some posture tools check whether the web controls a customer already owns are set up well. A shared category list gives the audit a neutral baseline.
- Compare each policy against a baseline of categories that should be blocked everywhere, such as Malware / Phishing / Suspicious and VPN / Proxy / Anonymizers.
- Flag groups, sites or locations where risky categories are allowed, and show who owns the exception.
- Check that privacy categories such as Online Banking and Health & Medicine are excluded from decryption where local rules require it.
- Test a set of known domains per category to see what the policy actually does, not only what it says.
- Report drift: categories that were blocked last month and are allowed now.
Third-party and supply chain domains
Posture now reaches beyond the company's own tenants. Vendors, integrations and scripts bring their own domains, and categories help judge them at scale.
| Source of third-party domains | What to check | Category signal |
|---|---|---|
| Vendor inventory | Do the listed vendor domains match their stated business? | A payroll vendor whose domain is parked or labelled File Sharing/P2P needs review |
| Scripts loaded by company websites | Which outside domains run code on your pages? | Advertising/Marketing, URL Shorteners and unknown new domains get extra scrutiny |
| Integration publishers | Who built the apps connected to your tenants? | AI / LLM Tools publishers and unknown publishers rise to the top |
| Software update and package sources | Where do build systems fetch code from? | Developer Tools / Code Hosting is expected; file hosts and parked domains are not |
| Partner sharing domains | Which outside domains can see company files? | Free Email providers and public storage in a partner list are a gap |
Build steps for a posture product team
Adding category data to a posture product is a short project. These steps take it from a prototype to a feature customers rely on.
- Extract domains. Write one parser that pulls hosts and registered domains out of every configuration type you already collect.
- Load the database. Import the licensed file into your backend and index it by host and registered domain.
- Map severity. Turn categories into default severities per finding type, and let customers edit them.
- Add ownership checks. Combine the category with tenant and ownership data so company-owned storage is not flagged.
- Ship approvals. Let customers accept a domain per tenant, with a reason and an expiry date.
- Apply deltas daily. Update the database before each scan cycle and record the build date with every finding.
- Report by category. Group findings and score changes by category in dashboards and executive reports.
Mistakes to avoid
Posture tools win or lose on trust in their findings. These mistakes produce noise or confusion.
Severity from category alone
A storage domain in a sharing list is only a problem if it is not the company's own tenant. Combine category with ownership data.
No approvals
Customers need to mark a finding as accepted. Without it, the same items return every scan and teams stop reading.
Stale labels
A domain that was fine last year may be parked today. Apply deltas and the monthly refresh before each scan.
Only the top label
Mixed sites carry several ranked labels. Severity should look at the riskiest one.
Parent domain only
Shared platforms host very different content on different hosts. Check the full host first.
No explanation
Every finding should say which category triggered it and why that category matters.
Licensing for posture management vendors
Categories that appear in findings, scores and reports are an embedded use of the data, which an OEM licence covers.
OEM licence
For SSPM, CSPM, DSPM and exposure products where your customers see categories in findings.
Group-wide licence
For vendors with several posture and security products under one company.
Not allowed
Resale or publication of the raw data, such as offering the full categorized list as an export.
Posture management category data questions
Why would a posture management product need URL categories?
Configurations are full of domains: webhook targets, integration publishers, forwarding rules, egress allow lists, sharing domains and DNS records. Categories tell the product what kind of site each domain is, which turns a long list of settings into ranked findings.
Which posture products use category data?
SaaS security posture management, cloud security posture management, data security posture management, exposure management and attack surface tools. Each uses categories to judge the destinations that appear in configurations and logs.
Do posture checks need real-time lookups?
Rarely. Posture scans run on a schedule over configurations and logs, so batch lookups and a local copy of the database fit well, and freshness matters more than latency.
Which categories produce the most important findings?
Cloud Storage / File Hosting, File Sharing/P2P, Email, AI / LLM Tools, URL Shorteners, Parked / For-Sale Domains, VPN / Proxy / Anonymizers, Remote Access Tools and Malware / Phishing / Suspicious. Unknown and very new domains also deserve attention.
Can categories help find dangling DNS records?
They can help. A company subdomain whose target now resolves to a parked or for-sale page is a strong sign of an abandoned resource, though posture tools still need to confirm the DNS and cloud resource state.
How are AI apps covered?
The AI / LLM Tools category is backed by 11,800+ AI-tool domains in 18 categories and 165 subcategories, updated daily. Posture tools use it to flag AI integrations, connected AI apps and AI destinations in egress and sharing settings.
How fresh is the data?
About 300,000 newly registered domains are categorized every day and delivered as daily delta files, with rechecks after a week and after a month. All other domains are refreshed monthly.
What licence does a posture management vendor need?
An OEM licence, because categories appear in findings and scores your customers see. Group-wide licences cover several products, and resale or publication of the raw data is not allowed.
Can category data reduce noise in posture findings?
Yes, destinations in normal business categories can be logged instead of raised, while storage, file sharing, personal email, anonymizers and parked domains are raised first. Combined with ownership checks and approvals, this keeps finding lists short and relevant.
Does the data cover subdomains as well as registered domains?
Where a host serves different content from its parent, it can carry its own labels. Look up the full host first and fall back to the registered domain, which matters for shared platforms and for a company's own subdomains.
Turn configuration domains into clear findings
Tell us which posture checks you run and how often you scan. We will suggest a file or batch setup and the OEM licence that fits your product.
Talk to us OEM licensing