Start here

Seven steps. No security background needed. Most of them are just pressing yes or no.

What this app is, in one sentence

Every other tool lists the devices it found. DARKMAP tells you how many devices you are missing, shows where they probably are, and helps your people find them.

step 1Load the example company

Press the button on the Missing devices page called "Load example company". It fills the app with three networks: the office, the cloud, and a factory floor that is partly disconnected.

Go to Missing devices

step 2Read the big number

The big number is how many devices you are probably NOT seeing. "At least 33%" means: for every 100 devices in that network, about 33 are unknown to all your tools. The number is a floor: the truth can only be higher, never lower.

See the number

step 3Answer simple questions

Press "Answer questions". The app asks yes/no questions about things it cannot see, big picture first: "Are there machines with their own controllers on the factory floor?", then "Are they PLCs?", then "Made by Siemens?", "Only one tool saw this printer, is it still there?", "Does Amal look after this device?". You never type. Each yes is turned into a record with the product's details filled in for you, until the unknown part of every network is explained.

Start answering

step 3Look at the map

Every network is a box. Grey dots are devices you know. The big dashed black circle is the group of devices nobody has seen. Tap it, then press "Ask someone to check": the app picks the technician who already works in that area and gives them a task.

Open the map

step 4Let a technician report what they see

On a phone, open "Report a device". Scan a sticker or type what is on the label, answer one question, and press Send. It works with no internet: the report waits and sends itself later. For a network with no internet at all, press "Save as file" and carry the file out on a USB stick.

Try reporting

step 5Run the safety checks

Safety checks are things like "isolate", "harden", "detect" from the MITRE D3FEND standard. The app refuses to run them on a network you barely know, and tells you exactly what information is missing. Once technicians have reported enough devices, the checks unlock and turn into tasks on the To-do list.

Open safety checks

step 6Run security from one screen

Open "Team lead". It shows how safe you are (never higher than the share of devices you know), the list of what to do next ranked by how unknown each network is, and who carries the unknown. Risks, rules, incidents and people each have their own page, all fed by the same records.

Open the team lead screen

Words you will see

Network (segment)	A group of devices, like "office", "cloud" or "factory floor".
Source (observer)	Anything that can see devices: a security agent, a network scan, a support ticket, a person with a phone, or a file carried on USB.
Sighting	One source seeing one device one time. The app never deletes sightings.
Missing (unobserved)	Devices that exist but no source has seen. The app estimates how many by comparing what different sources saw.
Task (gap ticket)	A request for a person to go and look. It goes to whoever already works in that area.
Risk	Something that could go wrong. Scored by how likely × how bad, then raised by how unknown its network is.
Rule	A requirement from the NIST or ISO standard, checked against your records. Never scores above the known share.
Slipped	A rule that was OK and is not trusted any more because its network got darker.
Safety check (D3FEND tactic)	A defensive action from the MITRE D3FEND standard: harden, detect, isolate, deceive, evict, restore.