Guides
Running two brand protection vendors at the same time, and how to split the work
How to run two brand protection or takedown vendors at once without duplicate filings: splitting channels, sharing authorization and comparing results.
ChainPatrol
Team
Yes, you can run two brand protection vendors at the same time, and many teams do for a quarter while they decide. It also works as a permanent setup when one vendor is a platform your security team uses for visibility and the other is a managed service that does the filing. The risks are duplicate notices to the same registrar, two vendors blocking different things, and nobody owning a case because each assumes the other has it. This guide covers how to split the work, what to share with both vendors and how to compare them fairly.
We make ChainPatrol, so read this knowing where we sit. We describe how our own service works, and the points here apply to any vendor. If something is out of date, tell us and we’ll fix it.
Key takeaways
Split by channel, by function, or by brand and region, and write down who files first where the split overlaps.
Give each vendor its own letter of authorization, scoped to what it files for.
Compare over the same period and the same channels, and count open cases as well as closed ones.
Three ways to split
By channel
One vendor owns domains and the other owns social and community channels. It is clean, easy to compare and avoids duplicate filings. It works well when your incumbent is a domain specialist.
By function
A platform detects and reports, and a managed service files and follows up. The platform’s alerts are forwarded to the service. This works when your team values the dashboard but not the queue.
By brand or region
Each vendor protects a different brand or market. It is simple to administer but harder to compare, because the threat volume differs.
What to share with both
A letter of authorization for each vendor, scoped to their channels. These are not exclusive, so one does not conflict with the other.
Your allowlist of official domains, accounts and apps, so neither vendor acts on your own assets.
A single escalation contact on your side.
Agreement on who files first for anything that falls across the split.
How to compare fairly
Same period, same brands and the same channels where possible.
Count what each found that the other did not.
Measure time to block and time to takedown, and look past the totals.
Look at open cases at the end of the period. A vendor with many completed cases and many stale open ones is not following up.
Ask your support team which month had fewer scam tickets.
Already have a security platform?
A general security or threat intelligence platform will find some impersonation, though it often leaves the takedown filing and the chasing of registrars to your team. A managed brand protection service can sit next to it and handle that part. Feed the platform’s findings to the service and compare what happens to them.
Frequently asked questions
Will two vendors send duplicate takedown notices?
Only if they cover the same channel without coordination. Split by channel or function and agree who files first for anything that overlaps.
Do we need separate letters of authorization?
Yes, one per vendor, scoped to the channels each one files for. A letter of authorization is not exclusive, so it doesn’t conflict with the authorization you gave another vendor.
How long should a side-by-side trial run?
One full quarter is enough to see a volume spike and the follow-up on cases that stall.
Can ChainPatrol run alongside another vendor?
Yes. Teams often run ChainPatrol next to an incumbent vendor, for example during a trial. See how ChainPatrol compares with PhishFort as one example.
See what’s impersonating your brand before you decide. Get a free scan.
Sources
Accessed November 2026. Check each source for the latest.
Yes, you can run two brand protection vendors at the same time, and many teams do for a quarter while they decide. It also works as a permanent setup when one vendor is a platform your security team uses for visibility and the other is a managed service that does the filing. The risks are duplicate notices to the same registrar, two vendors blocking different things, and nobody owning a case because each assumes the other has it. This guide covers how to split the work, what to share with both vendors and how to compare them fairly.
We make ChainPatrol, so read this knowing where we sit. We describe how our own service works, and the points here apply to any vendor. If something is out of date, tell us and we’ll fix it.
Key takeaways
Split by channel, by function, or by brand and region, and write down who files first where the split overlaps.
Give each vendor its own letter of authorization, scoped to what it files for.
Compare over the same period and the same channels, and count open cases as well as closed ones.
Three ways to split
By channel
One vendor owns domains and the other owns social and community channels. It is clean, easy to compare and avoids duplicate filings. It works well when your incumbent is a domain specialist.
By function
A platform detects and reports, and a managed service files and follows up. The platform’s alerts are forwarded to the service. This works when your team values the dashboard but not the queue.
By brand or region
Each vendor protects a different brand or market. It is simple to administer but harder to compare, because the threat volume differs.
What to share with both
A letter of authorization for each vendor, scoped to their channels. These are not exclusive, so one does not conflict with the other.
Your allowlist of official domains, accounts and apps, so neither vendor acts on your own assets.
A single escalation contact on your side.
Agreement on who files first for anything that falls across the split.
How to compare fairly
Same period, same brands and the same channels where possible.
Count what each found that the other did not.
Measure time to block and time to takedown, and look past the totals.
Look at open cases at the end of the period. A vendor with many completed cases and many stale open ones is not following up.
Ask your support team which month had fewer scam tickets.
Already have a security platform?
A general security or threat intelligence platform will find some impersonation, though it often leaves the takedown filing and the chasing of registrars to your team. A managed brand protection service can sit next to it and handle that part. Feed the platform’s findings to the service and compare what happens to them.
Frequently asked questions
Will two vendors send duplicate takedown notices?
Only if they cover the same channel without coordination. Split by channel or function and agree who files first for anything that overlaps.
Do we need separate letters of authorization?
Yes, one per vendor, scoped to the channels each one files for. A letter of authorization is not exclusive, so it doesn’t conflict with the authorization you gave another vendor.
How long should a side-by-side trial run?
One full quarter is enough to see a volume spike and the follow-up on cases that stall.
Can ChainPatrol run alongside another vendor?
Yes. Teams often run ChainPatrol next to an incumbent vendor, for example during a trial. See how ChainPatrol compares with PhishFort as one example.
See what’s impersonating your brand before you decide. Get a free scan.
Sources
Accessed November 2026. Check each source for the latest.
See what’s targeting your brand
More buyer’s guides
How PhishFort and ChainPatrol compare on coverage, blocking before takedown, case visibility and fit, written by ChainPatrol.
ChainPatrol
Guides
Six brand protection and scam defense options crypto exchanges evaluate for fake support accounts, cloned logins, fake apps and phishing domains.
ChainPatrol
Guides
The main alternatives to PhishFort for phishing and impersonation takedowns, who each fits, and the questions to ask before you switch or add a vendor.
ChainPatrol
Guides