01
Submit domain
The request captures the organization, authorized domain, and business context without starting an assessment or taking payment.
How the platform works
How KMayer Exposure Lens AI moves from a verified request to paid entitlement, assessment, and private outcomes.
The customer submits an authorized domain, verifies the business email, confirms scope, reviews the managed asset estimate, and approves the published subscription when eligible. Assessment processing starts only after PayPal confirmation is verified server-side and the matching tenant entitlement is active.
Run a reviewFAQTool use policyKMayer Exposure Intelligence Evidence-to-Closure MethodologyExposure Capability Map for ASM, EASM and CTEM | KMayerKMayer Exposure Lens AI Product Tour | Evidence to Verified RecheckExposure Integrations and Deployment | KMayer Exposure Lens AISecurity and Data Handling | KMayer Exposure Lens AI
Executive journey view
From request to payment, entitlement, processing, and private delivery, every gate is explicit.
02
Verify email
The business recipient verifies the email before private scope and commercial details become available.
03
Review assets and price
The verified recipient confirms the asset boundary and reviews the provisional capacity, count-once reconciliation, and GBP price.
04
Approve PayPal subscription
Eligible buyers approve the selected capacity and billing cycle in PayPal Live; larger capacities remain sales-assisted.
05
Verify entitlement
KMayer activates entitlement only after a verified provider event is reconciled to the organization and license.
06
Assessment runs
The entitled organization and licensed asset boundary enter processing while the private status page reports progress.
07
Workspace and outputs
The tenant receives evidence-backed priorities, reports, remediation workflow, recheck state, and governed expansion options.
Review journey
The customer journey preserves authorization, price visibility, tenant isolation, and server-side entitlement from start to finish.
Step 1
Submit the domain and business details
Every request starts with domain validation, normalization, and guarded input handling before any public fetch begins. Invalid, private-address, localhost, and suspicious targets are rejected up front.
Bounded request capture before any review starts.
Step 2
Verify the business email
The one-time verification link confirms the intended recipient before any private scope, estimate, checkout, workspace, or result becomes available.
Verification does not take payment or start an assessment.
Step 3
Confirm assets and the authorized boundary
The verified recipient reviews the domain and declares known asset quantities. Unknown classes may remain at zero while the estimate stays provisional.
Only owned or explicitly authorized assets may enter scope.
Step 4
Review the provisional managed asset estimate
The request-status page shows the asset-class breakdown, count-once reconciliation, recommended capacity, annual list price, and monthly price under the published commitment.
The estimate is visible before PayPal approval and creates no charge.
Step 5
Choose capacity and billing cycle
Eligible buyers select a supported capacity and annual or monthly billing. Direct checkout is limited to the published capacities; larger environments require sales-assisted approval first.
Capacity cannot be reduced below the provisional recommendation.
Step 6
Approve the subscription in PayPal Live
PayPal presents the selected GBP price and billing cycle. Returning from PayPal does not activate access; KMayer waits for provider-verified server-side confirmation.
The browser cannot grant entitlement or start processing.
Step 7
Activate access only after verified payment
A verified PayPal webhook is reconciled to the organization, selected capacity, subscription, and immutable payment record before the server activates entitlement.
Unverified redirects and front-end events never grant access.
Step 8
Run the assessment within the paid boundary
Only the entitled organization, authorized domain, and licensed managed asset capacity enter the assessment queue. Status remains visible while evidence is collected and correlated.
No payment confirmation means no assessment run.
Step 9
Open the tenant workspace and completed outputs
The entitled tenant receives its private workspace and verified private result, including executive and technical views, evidence, priorities, remediation state, recheck state, and available report or export actions.
Tenant isolation and role policy protect every private output.
Step 10
Add approved sources without widening entitlement silently
Read-only connectors, authorized exports, monitoring, history, and deeper validation activate only when the source is supported, authorization exists, and the tenant boundary permits it.
Additional capacity or commercial scope always requires an explicit governed action.
Decision matrix
Know what happens before payment, what the subscription activates, and what requires additional authorization.
What you get now
- A protected request, verified scope, and provisional managed asset estimate before payment.
- Published GBP pricing and an explicit PayPal approval step for eligible capacities.
- No assessment processing until verified payment and server-side entitlement are active.
What gets deeper with authorization
- Read-only connector-backed evidence when the tenant or domain is approved.
- Trusted export intelligence after quarantine, review, and approved-for-parse controls.
- Stronger provenance, vendor and asset context, monitoring continuity, and remediation sequencing.
What KMayer can validate next
- Whether the highest-risk signals map cleanly to real control owners and operational impact.
- Whether the authorized enterprise lane is commercially justified for the reviewed environment.
- How to turn the result into a practical remediation conversation without widening scope unsafely.
Why verification is required
Verification confirms the intended business recipient before private scope and commercial information is disclosed. It does not create an entitlement, take payment, or start processing.
What public mode never does
Public mode remains passive-only. It does not perform login attempts, brute force, credential spraying, exploit behavior, intrusive testing, hidden-path probing, or active internet-wide scanning.
What KMayer can help with after the review
KMayer can validate the findings, prioritize the highest-impact fixes, determine whether authorized deeper review is justified, interpret connector-backed or trusted-export evidence, and move the work into assisted remediation planning.
Who provides the review
KMayer provides KMayer Exposure Lens AI as a self-service digital software product. Human-delivered consulting, managed IT services, and penetration testing are separate and are not included in the software subscription.
Where deeper evidence comes from
Deeper evidence is governed, verified, and added only when it improves decision confidence.
The entitled assessment begins with passive evidence. When ownership, subscription scope, and source authorization are verified, KMayer can extend it with approved read-only connector context, trusted export intelligence, monitoring, history, and remediation sequencing.
Passive evidence first
Public signals define the safe base layer.
After verified payment and entitlement, the opening assessment lane is passive and bounded: DNS, mail posture, HTTPS, TLS, trust files, indexing signals, and capped same-host public evidence become signal layers before any deeper lane is considered.
- DNS, mail trust, HTTPS, TLS, headers, trust files, and indexing as evidence sources.
- No login attempts, brute force, exploit behavior, or intrusive widening.
Governed deeper context
The authorized enterprise lane activates only with proof and scope.
The deeper lane is not anonymous. It requires verified ownership, active engagement, approved scope, and explicit approval for read-only connector evidence or trusted export intelligence.
- Connector and export evidence remain read-only, attributable, and bounded.
- Private noindex handling and verification controls continue to govern access.
Decision-ready follow-through
Deeper evidence improves confidence, history, and remediation sequencing.
When eligible, connector and trusted-export context can strengthen provenance, vendor ecosystem interpretation, passive asset inventory, monitoring, history, and the sequence of practical remediation work.
- Use deeper context to validate priority and ownership before change work.
- Move from findings into KMayer-assisted remediation planning when justified.
Passive first
Verified ownership
Approved read-only evidence
Private noindex result
KMayer-assisted remediation
Read the public-signal guides that explain what the passive lane is observing.
Use these guides to understand the boundary between safe public evidence, governed deeper review, and practical next steps.
Passive External Exposure ReviewUnderstand how passive public-signal evidence supports exposure intelligence and what it cannot claim.Exposure Evidence ChecklistUse a structured checklist for DNS, mail, TLS, headers, trust files, and ownership as evidence layers.Email and Web Trust SignalsReview SPF, DKIM, DMARC, TLS, HTTPS, headers, and visible trust signals as exposure evidence inputs.
