DefendDomain compared to CTM360
CTM360 is a consolidation play, bundling external attack surface management, digital risk protection, threat intelligence, third-party risk and DMARC into one subscription.
We call you within one working day. Or book a 30-minute demo: enough for us to give you a clear annual price for your domains.
CTM360 at a glance
CTM360 consolidates external attack surface management, Digital Risk Protection (DRP) and threat intelligence into one subscription, and publishes a rate card for it.
DefendDomain does one of those things, in more depth. If you are genuinely retiring four vendors into one subscription, the bundle is a real saving; if you are retiring none and lookalike domains are the gap, it buys you modules you will not switch on.
- CTM360 is built around
- A consolidated external risk suite
- Typically sold to
- SMB to enterprise
- Typical annual cost
- Published rate card, from the low thousands for the platform into the tens of thousands for brand protection
DefendDomain and CTM360, side by side
The short version, before the case for either of us. Every claim in the CTM360 column comes from their own published material.
What the product is built around
DefendDomain
Finding web addresses made to look like yours and getting them taken down: lookalike domains, new certificates, copies of your website and of your wording, plus a daily check of your own domains
CTM360
Consolidated external risk suite spanning attack surface management, digital risk protection, threat intelligence, third-party risk and DMARC
Lookalike domains that never host a website
DefendDomain
We check the email set-up (MX, SPF, DKIM and DMARC records) of every registered lookalike. When one is set up to send email, we flag it, even if it has no website
CTM360
They publicly describe detecting recently registered typosquatting and lookalike domains across a large number of extensions. Checking a lookalike's email set-up (MX, SPF, DKIM and DMARC records) and flagging when it can send email is not listed in their public material as of September 2026
When someone copies your website
DefendDomain
The optional website marker (a small script or a 1×1 image on the pages you choose) reports when a copy of a page loads somewhere else, and we search the web for distinctive phrases from your site
CTM360
Impersonation and rogue app detection are published. A website marker on your pages, and web searches for your wording, are not listed in their public material as of September 2026
Takedowns
DefendDomain
Unlimited on Pro and Enterprise. One click sends the evidence to up to 12 places at once, with automatic follow-ups to the host, registrar and registry
CTM360
Managed takedowns, publicly metered by annual credits that rise with the tier and reach unlimited only at the top. The free community edition includes a small number
Your own domains
DefendDomain
A daily check of your own domains (email security, DNS and takeover risk, certificates, website settings, exposed files), graded A to F, with a fix for each finding
CTM360
DMARC monitoring is a published module and attack surface management discovers exposed assets. That is close to our daily check of your own domains on email security, with less on graded DNS, certificate and website settings
How you buy it
DefendDomain
Pro: an annual plan priced by the number of domains you protect, where you approve each takedown. Enterprise: priced to your needs, with our analysts running the takedowns
CTM360
Tiered subscriptions with a published rate card, which is rare in this category, plus a free community edition. Brand protection bands start in the tens of thousands a year and rise from there
Comparison based on CTM360's own public product material as of September 2026. Vendors change their products, so check anything that matters to you against their current documentation and your own quote. CTM360 is a trademark of its owner. DefendDomain is not affiliated with, endorsed by or sponsored by CTM360.
The facts your vendor review will ask for
About DefendDomain only. Check the same points with any vendor on your shortlist.
- What we check
- Around 500 lookalikes of each of your domains across 240+ domain endings, re-checked every hour. 100+ public certificate logs, watched as entries appear. Copies of your website and of your wording. Your own domains, checked daily and graded A to F.
- Where a takedown goes
- One click sends the evidence to up to 12 places at once: the registrar, the host, the email provider the domain sends through, an abuse-report network, blocklists and threat feeds, browser warning lists and search engines. Not every place applies to every attack: a domain with no website has nothing for a search engine to remove.
- Follow-up
- Automatic. We chase the host and registrar again at 48 and 96 hours, go to the registry at 120 and 168 hours, and tell you if nothing has moved after 30 days. Most takedowns take between 2 and 96 hours.
- Who approves a takedown
- On Pro, someone on your side confirms it is a live attack and approves it with one click. On Enterprise, our analysts check every alert and run the takedowns. Takedowns are unlimited on both.
- Alerts
- Email, Slack, Microsoft Teams, SMS, webhook, Splunk, Microsoft Sentinel and Wazuh.
- Security and data
- ISO 27001 certified (certificate 535732026) and Cyber Essentials certified. UK GDPR and EU GDPR. Our main database is hosted in London (AWS eu-west-2).
- Which plan suits whom
- Pro suits companies that approve takedowns themselves. Enterprise covers unlimited domains and brands, run by our analysts.
- Price and contract
- Pro is an annual plan with 5 domains included, priced by the number of domains you protect. Enterprise is priced to your needs. Both are annual: a 12-month minimum, renewing each year unless you give 30 days' notice. We do not publish the Pro price yet.
We call you within one working day to talk it through.
ISO 27001 certified · Cyber Essentials certified · Winner, teiss Cyber Security Start-up of the Year 2026
What CTM360 does well, and who should buy them
Taken from what CTM360 publishes about its own product. If this is the shape of your problem, they are a reasonable buy and we will say so.
One subscription instead of four vendors
For a security team responsible for the whole external risk picture, consolidating attack surface management, threat intelligence and brand protection into one contract is a real reduction in overhead.
Published starting prices
They publish tiered starting prices and offer a free community edition, which is unusually transparent for this category and makes budgeting possible before a sales call.
Managed operations included
Their model includes managed detection and managed takedown around the clock, which matters if you are buying breadth and do not have the headcount to run all of it.
Where DefendDomain goes deeper
We work on one problem: web addresses made to look like yours, and copies of your website. We find them, tell you which can send email or show a copy of your site, and get them taken down when they are used against you.
Where a bundled module tends to stop
Brand protection inside a multi-module suite competes for engineering attention with attack surface management, threat intelligence, third-party risk and DMARC. We work only on lookalike domains and copies of your site: around 500 lookalikes per domain across 240+ domain endings, re-checked every hour.
One confirmed attack helps find the next
When an attack is confirmed, we record the registrar, name servers and email providers it used, and compare your other lookalikes against them, giving more weight to rarer matches. That is the kind of thing a specialist builds and a suite generally does not.
Two checks that find copies of your site
The optional website marker reports when a copy of a marked page loads somewhere you do not control, and we search the web for distinctive phrases from your site.
What each of us costs
Most vendors in this category do not publish a price list. This is how each of us charges.
- What CTM360 publishes
- CTM360 publishes a rate card, running from the low thousands for the platform into the tens of thousands once brand protection is included.
- What moves the number
- Consolidation plays price by module. The saving is real if you genuinely retire the tools the modules replace, and illusory if you keep paying for them alongside.
- How DefendDomain charges
- No modules to assemble. Pro is one annual plan priced by the number of domains you protect, and we do not publish the price yet.
Choose CTM360 if
- Your mandate genuinely covers attack surface management, threat intelligence and third-party risk as well as brand abuse.
- Consolidating four vendors into one contract is the outcome your budget holder wants.
- You want a published rate card and a free tier to evaluate against before committing.
- Broad coverage at a modest entry price matters more than depth on any single layer.
- Your security team is small, and one console across several risk categories is easier to staff than four separate tools.
Choose DefendDomain if
- Domain impersonation is the problem, and the rest of a suite would be bought and not used.
- You need to know when a lookalike with no website is set up to send email.
- You want each confirmed attack used to spot other lookalikes from the same attacker.
- Somebody copying your website is a live risk and you want the website marker and web searches for your wording on it.
- You want unlimited takedowns on Pro and Enterprise rather than an annual credit allowance that only becomes unlimited at the top tier.
What moving actually involves
There is no software to install and no data to move. Lookalike monitoring, certificate watching and the daily check of your own domains need only your domain names. The website marker is optional: a small script or a 1×1 image on the pages you choose.
Step 1
Test the consolidation claim honestly
Write down the tools a suite would let you cancel, then ask whether you would actually cancel them. If the answer is none, you have added a subscription rather than replaced several.
Step 2
Compare the domain module, not the suite
The fair comparison is CTM360's brand protection module against our whole product, because that is the overlap. Everything else they do is outside our scope and we are not claiming otherwise.
Step 3
Check what you are locked into first
A consolidation contract usually bundles several modules onto one renewal date, so dropping the brand protection module early is rarely an option. Find out when the term ends before you plan anything. If the domain layer is the part that is underperforming, run us alongside it until then.
Questions buyers ask us about CTM360
CTM360 publishes pricing and bundles several tools. Why would we pay for a specialist as well?
You might not, and if consolidation is genuinely the goal then a suite with a published rate card is a rational buy. The question worth asking is what the brand protection module does when the lookalike never hosts a page. Our answer is that we check the email set-up of every registered lookalike and flag each one that is set up to send email. That is how fake invoice domains work, and they leave the least to detect. If that specific failure mode is your worry, a module is unlikely to go that deep.
Is a suite or a specialist the better buy?
It depends on your mandate. If you are accountable for the whole external risk picture, a suite reduces the number of vendors you manage, which has real value. If your main worry is a domain that looks like yours being used to defraud your customers or redirect a supplier payment, a product that does only that will go further down it than a module competing for attention with four others.
Does DefendDomain cover external attack surface management?
Only the part that touches domains. Our daily check finds your subdomains from public certificate logs and grades email security, DNS and takeover risk, certificates, website settings and exposed files, with a fix for each finding. Full external attack surface management across cloud infrastructure and shadow IT is not something we do.
Can DefendDomain sit alongside a suite we already have?
Yes. You can use the suite for breadth and us for lookalike domains. Alerts go to whatever you already use: email, Slack, Microsoft Teams, SMS, webhook, Splunk, Microsoft Sentinel or Wazuh.
Comparing more than one vendor
Most shortlists have three names on them. The same comparison is here for the others, or start from the full comparison hub.
Free scan. No account, no card details.
See your own exposure before you shortlist anybody
Whichever way this decision goes, it is worth knowing which lookalikes of your domain are already registered. The free scan checks 150+ of them in a couple of minutes and emails you the report.
- Typos, other endings and added words, such as yourcompany-invoices.com
- Which ones are registered, and which are set up to send email as you
- The report in your inbox, usually in a couple of minutes. No account, no card details, no sales call.
