Use this in writing before a demo. Short answers are fine; vague ones are the finding. It pairs with our two-week POC and the wider vendor checklist.
Detection
1. Which sources run in real time, and which on a schedule? How often?
2. How are findings scored, and what’s the threshold for action?
3. How are our official assets protected from being flagged?
Blocking
4. Do you block confirmed sites while the takedown runs? Where, and how fast?
5. What happens if one of our real assets is flagged by a third party?
Filing
6. Which filing routes are automated? Which still go by email?
7. Which registrars and hosts are integrated directly? Name them.
8. How are social platforms filed, and under which policies?
9. Are registrar, host and proxy filed together or in sequence?
People
10. What exactly goes to a person? List the cases.
11. Does a confirmed phishing site ever wait for a person?
12. Can approvals be turned off? What’s the default?
Follow-up
13. Is re-filing automated? On what schedule?
14. When do you escalate, and to whom?
15. How do you verify removal, and what happens on reactivation?
Reporting and numbers
16. Does the report show cases still live, with status and timestamps?
17. What does your speed figure measure, on which cases, over what period?
18. How many cases per day can one customer run?
19. What’s your false positive rate, and how is it measured?
20. What’s excluded from “unlimited” or “included”?
ChainPatrol’s answers
On automated takedowns, escalation, approvals, registrar integrations, false positives, speed and reporting. Where we don’t have a figure yet, the page says so.
Frequently asked questions
Which three questions matter most?
Six, ten and sixteen: which routes are automated, what reaches a person, and whether still-live cases are reported.
Book a 30-minute demo or request a complimentary threat assessment.
Related guides
