SpyCloud Compass is presented through a page that redirects to SpyCloud Endpoint Threat Protection, a web product for SOC teams remediating malware-related exposure. It shows evidence of data malware stole and links exposures to an organization’s environment. Monitored information includes credentials, accounts, applications, cracked passwords, session tokens, cookies, PII, and malware records. Teams can use this identity exposure data for password resets, session invalidation, and access reviews to limit follow-on attacks such as account takeover, lateral movement, and ransomware. The product surfaces exposures from managed and unmanaged endpoints, including BYOD laptops and remote contractor devices. SpyCloud lists EDR, SIEM, and SOAR integrations including CrowdStrike Falcon, Microsoft Defender, Splunk, Elastic, Google Chronicle, Palo Alto Cortex XSOAR, and Tines. Identity integrations include Active Directory, Entra ID, Okta, and Ping Identity. Enterprise Protection pricing is tiered by employee accounts protected and available on request. SpyCloud says the product reports stolen data rather than detecting malware.
Who it is for
This product is intended for SOC teams handling malware-infected users and applications. It fits organizations that need exposure data connected to endpoints, identities, and response workflows.
What is good
- Covers managed and unmanaged endpoints
- Supports password resets and session invalidation
- Integrates with EDR, SIEM, and SOAR tools
- Monitors credentials, tokens, cookies, and PII
- Premium Support offers 24/7 critical-issue coverage
What to know first
- Does not detect malware
- Pricing is available only on request
- Enterprise pricing scales by employee accounts
Verdict
SpyCloud Endpoint Threat Protection focuses on what malware extracted and the remediation steps that follow. Its endpoint coverage, identity integrations, and response workflows support SOC operations, but malware detection itself is outside the product’s stated role.
SpyCloud Compass plans and pricing
All plansCompared on dark web monitoring services
- Business monitoring
- Yes
- Monitored data types
- credentials, accounts, applications, cracked passwords, session tokens, cookies, PII, malware records
- Remediation support
- Yes
