Maintain visibility as your external surface evolves.

New deployments, DNS changes and third-party services can introduce exposure beyond the assets your team already tracks. Recurring discovery and security checks help identify overlooked hosts, configuration gaps and exposed resources, with evidence for review.

Discovery

Build an external asset inventory using DNS enumeration, certificate transparency and active resolution.

Posture & exposure

Assess email authentication, TLS, DNS and HTTP configuration alongside exposed files, public storage and takeover indicators.

Continuous monitoring

Schedule recurring checks and track new findings, resolution and recurrence across monitored assets.

What is included

Build an inventory of your internet-facing assets.

Start with the domains in your scope. Discovery combines DNS and certificate data to identify associated hosts, record reachable assets and track their first and most recent observations.

Subdomain & CT-log discovery Identify associated hostnames through DNS enumeration and public certificate records.
Change tracking Compare first-seen and last-seen observations to investigate changes in asset visibility.
Services & certificates Review service and certificate information alongside the assets it belongs to.

Assess configuration gaps and exposed resources.

Findings distinguish configuration weaknesses from exposure indicators and include the observed evidence. Review the affected asset and severity to decide which issues require immediate attention and which belong in planned remediation.

Email, TLS & DNS posture SPF/DMARC/DKIM/DNSSEC, certificate expiry and protocol, zone transfer, CAA and wildcard checks.
Headers, cookies & tech Missing security headers, weak cookie flags and version-disclosing banners across the surface.
Exposure findings Identify exposed repositories, environment files, backups, public buckets, JavaScript secrets and API descriptions using targeted checks.
Takeover risk Subdomains that still point to a service you no longer use, which someone else could claim.

Track posture throughout the remediation cycle.

Recurring assessments help validate remediation and identify regressions. Findings and posture grades update as checks complete, giving engineering a working queue and leadership a view of progress over time.

One posture score, A to F Review the posture grade alongside the findings and observations behind it.
Self-resolving findings Follow finding status across completed assessments, including automatic resolution and reopening when an issue recurs.

Define scope. Discover assets. Investigate findings.

01

Add a domain

Select an authorized domain and the monitoring scope for its external assets.

02

Discover and assess

Run discovery and the selected security checks, then repeat assessments on the configured schedule.

03

Triage with context

Review evidence, prioritize remediation and use subsequent assessments to track progress.

Questions

Do the checks affect our sites?

The checks are light requests of the kind any visitor or search engine makes. They do not try to break in, and they only run against domains you have added and confirmed you are allowed to assess.

How is this different from vulnerability management?

Attack Surface Management looks at what anyone on the internet can see, without installing anything. Vulnerability Management looks inside each machine through the agent. Many teams use both.

How often are the assets checked?

On the schedule you set for each domain. A finding that is fixed closes on its own after the next assessment, and reopens if the problem comes back.

Know your external assets. Prioritize their exposure.