EASMYour external attack surface, mapped from a single domain.

A scanner like Nessus or OpenVAS starts from a list of IPs you feed it and tests vulnerabilities on them. It only sees what you declare. EASM answers the question before that: what are you really exposing on the Internet? It starts from a single root domain, discovers the assets nobody inventoried (forgotten subdomains, staging left online, cloud buckets), correlates those assets with each other through shared certificates, DNS and ASN, then continuously monitors what appears and disappears. The two are complementary: the scanner goes deep on the known, EASM finds the unknown.

You enter your root domain, the scan starts. No agent to install, no cloud access to provide. We combine 14 discovery plugins: passive sources (Certificate Transparency via crt.sh, six public subdomain sources, WHOIS and reverse WHOIS, DNS), then non-intrusive active steps (port scanning, service fingerprinting, vhost enumeration, web crawling, cloud detection for S3/Azure/GCP). Step by step, we pull up subdomains, IPs, ports, TLS certificates, technologies and exposed services. The scope stays under your control: we unroll from the domains you declare, no reckless attribution to entities that aren't yours.

Yes. Public S3 buckets, Azure Blob Storage, GCP Storage, exposed instances, subdomains pointing to a CDN or a cloud host. Dedicated modules also check storage ACLs and metadata leaks (cloud SSRF). If a cloud asset is reachable from the Internet and tied to your domain, it surfaces in the inventory.

You schedule periodic scans (cron) and trigger on-demand scans from the interface or the API. On every pass, you get the delta: new asset, port that opens, new CVE on an exposed service, finding resolved. Volumes depend on the plan: 10 scans a month on Discovery, 100 on Pro, unlimited on Business and Enterprise. You track your usage in real time.

The scan is refused and the API returns an HTTP 402 until the monthly renewal or an upgrade. All quotas (scans, monitored assets, AI validations, API keys) are counted per calendar month and reset on the 1st. The dashboard shows your usage and an upgrade button. Note: the Discovery plan monitors up to 25 assets and 1 domain, the Pro plan goes up to 250 assets and 5 domains, Business up to 1,000 assets and 15 domains.

On a High or Critical finding, you can ask an autonomous AI agent to try to confirm it is actually exploitable. It has real offensive tooling (sqlmap, nuclei and others) that it runs against the affected asset, within strict guardrails: 20 steps, 300 seconds and 150,000 tokens per finding. If it proves exploitability, the finding moves to confirmed with a stored proof (secrets masked). It is AI, not a human pentester, and it is quota-limited: 2 validations a month on Discovery, 30 on Pro, 100 on Business, unlimited on Enterprise. We don't promise zero false positives. For thorough human verification, that's the job of our pentests, a separate offering.

Let's separate two things. EASM discovery and scanning are non-intrusive by design: no exploitation, no destructive payload, redirects disabled, per-host rate capped (1 to 1000 req/s), three-layer anti-SSRF guard. You can add it to your perimeter without coordinating with the ops team. AI validation, on the other hand, is active testing: it runs real tooling against the live asset, which can change its state. The sandbox isolates the tooling (ephemeral container, egress filtered to the target's public IPs only), not your asset. That's why it is manual, reserved for critical findings on a domain you have verified, and quota-limited. We'd rather say it than hide it.

Hosting in the EU, under European law. Your inventory data and findings stay under European law, isolated per account (strict per-tenant database partitioning), with secrets masked before they are written. No reselling, no sharing with third parties, no use to train external models. The optional AI validation calls Anthropic's Claude models through Google Cloud Vertex AI in a European region (standard contractual clauses, no training on your data). Handing your entire attack map to a US vendor exposes you to extraterritorial access requests, at odds with GDPR and NIS2: we keep hosting in the EU.

The scope is defined by the root domains you add (1 on Discovery, 5 on Pro, 15 on Business, unlimited on Enterprise): nothing outside is scanned. For each run, you tune custom headers and cookies (up to 50 each) and the maximum per-host rate. Useful to respect a WAF, a load window or a sensitive environment.

Article 21 of NIS2 mandates risk management that includes asset mapping and continuous monitoring of the exposed surface, shadow IT included. EASM addresses this part directly: a live inventory of exposed assets, CVE detection with KEV and EPSS prioritisation, an alert on the first change, PDF and CSV reports exportable for your auditors. To be clear: it doesn't cover all of NIS2 on its own (governance, incident response, supply chain remain on you). It addresses the knowing and controlling what you expose part.