What does the deep profile add?

Best move: reach for deep when a graded, dated, confirmed answer changes your move, not by default.

Why it works: standard already fuses all five layers in one pass. Deep spends extra requests to add the security grade, confirm soft signals, and date when each one first appeared.

Key takeaways

• Deep is a superset of standard: every standard signal, plus three additions, never fewer.
• The three additions are a composed security grade, follow-on probes, and Wayback first-seen history.
• The security grade fuses an A-F header analysis with a TLS grade, so you read posture, not just the raw certificate.
• Wayback first-seen dates turn a detection into a timeline: whether a company shipped AI last month or two years ago.
• Follow-on probes confirm soft signals a single-pass crawl only hints at, at the cost of extra requests and time.

What does deep add that standard does not?

Standard already returns all five layers fused: tech stack, infrastructure, firmographics, AI-readiness, and the summary that ties them together. Deep does not bolt on a sixth layer. It deepens the dossier in three places. First, the security grade. Standard reports the raw TLS certificate inside the infrastructure layer (issuer, SANs, expiry, days_remaining), but deep grades the posture. It reads six response headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), scores them A through F, and fuses that with a TLS grade. Second, follow-on probes: extra targeted requests that confirm signals the first pass only suggested. Third, Wayback first-seen history: dated evidence from the public archive of when a given signal first appeared. Standard trades all three for speed and answers most questions without them. Deep spends the time when the question needs a graded, dated, confirmed answer instead of a fast one.

What do the follow-on probes do?

A single-pass crawl reads the pages it fetches, then stops. Some signals need a second look. Follow-on probes are targeted requests that chase a lead: resolve an llms.txt link and classify what it points to, request a .well-known AI file, check whether an MCP endpoint at /mcp responds and speaks the protocol, or fetch a script that a page referenced but did not inline. Each probe either confirms a soft detection or clears it. The AI-readiness layer benefits most, because deep backend fingerprinting rewards a second request that a homepage scan alone cannot justify. A model provider that one script only hints at becomes a confirmed provider once the probe resolves the call. The cost is honest: more requests, more time, and a larger surface for a slow or rate-limiting origin to stall the run. Deep pays for those probes. Fast and standard do not.

What does the Wayback first-seen history tell you?

A static snapshot tells you what a site runs now. It does not tell you whether that is a fresh bet or old furniture. Wayback first-seen history closes that gap. Bassethound reads public captures from the Internet Archive and reports when a signal first appeared. A vector store client visible in a capture from two years ago reads differently from one that landed last month. For an icp_signal, the first-seen date sets the temperature. A company that just shipped its first AI dependency is mid-decision, and mid-decision is when outreach lands. The limit is the archive itself. Coverage is uneven, the archive captures low-traffic sites rarely, and a first-seen date is a lower bound because the signal could predate the earliest capture. Deep reports the date it can defend and flags the uncertainty rather than dressing a snapshot up as a full timeline.

When is the deep profile worth the extra time?

Run deep when a slower, dated, graded answer changes what you do. Three cases cover most of it. You are scoring a security posture and need the header grade, not just the certificate facts. You are timing outreach and the first-seen date decides whether a lead is warm or cold. Or a standard pass returned a soft AI signal you want confirmed before you act on it. If none of those apply, standard is the right default: it fuses all five layers in a single pass and answers the question in front of you. Fast is for volume and latency-sensitive loops where deterministic tech and infrastructure are enough. Deep is not the setting you leave on. It is the setting you reach for when certainty and timing are worth the extra requests and the extra seconds.

What can the deep profile still miss?

Depth is not omniscience. Bassethound crawls the front end and, when the signals call for it, renders JavaScript. A fully server-side component that never touches the client leaves no signature to read. A proxied model call routed through a first-party backend hides the provider behind the site’s own domain. Follow-on probes only reach paths that exist and respond, so a private MCP endpoint or a gated .well-known file stays dark. Wayback coverage is thin for low-traffic sites, which means first-seen can arrive later than reality or not at all. Deep does not paper over any of this. The dossier marks what it could not reach and why, so you read the gaps as gaps rather than as proof the thing is absent. A confident detection is evidence. A blank is a question, not a no.

Bassethound perspective

Most tools sell depth as more detections. That is the wrong axis. A longer list of the same shallow checks does not make you more certain. It makes the report longer. Deep adds certainty and time instead. The security grade turns a raw certificate into a posture you can rank. The follow-on probes confirm a signal rather than guess at it. And the first-seen date is the one thing most tools charge a corpus subscription for: BuiltWith sells technology history as a proprietary dataset you rent. You do not need to own a history corpus to date a signal. The Internet Archive is public, and a per-call read of it gives you a defensible first-seen inside one request, with no lock-in. Competitors will dispute that, because the corpus is the product they charge for. We would rather report a lower-bound date, flag the archive’s blind spots, and let you act on it than sell you a snapshot dressed up as a timeline. Deep is what you run when the decision turns on when, how graded, and how sure, once standard’s fast fusion has already told you what.

Sources

• MDN, Content-Security-Policy header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
• MDN, Strict-Transport-Security header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
• IETF RFC 6797, HTTP Strict Transport Security: https://datatracker.ietf.org/doc/html/rfc6797
• Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org
• Model Context Protocol specification: https://modelcontextprotocol.io