Your external attack surface, mapped from a single domain.

A scanner like Nessus or OpenVAS starts from a list of IPs you feed it and tests vulnerabilities on them. It only sees what you declare. EASM answers the question before that: what are you really exposing on the Internet? It starts from a single root domain, discovers the assets nobody inventoried (forgotten subdomains, staging left online, cloud buckets), correlates those assets with each other through shared certificates, DNS and ASN, then continuously monitors what appears and disappears. The two are complementary: the scanner goes deep on the known, EASM finds the unknown.

You enter your root domain, the scan starts. No agent to install, no cloud access to provide. We combine 14 discovery plugins: passive sources (Certificate Transparency via crt.sh, six public subdomain sources, WHOIS and reverse WHOIS, DNS), then non-intrusive active steps (port scanning, service fingerprinting, vhost enumeration, web crawling, cloud detection for S3/Azure/GCP). Step by step, we pull up subdomains, IPs, ports, TLS certificates, technologies and exposed services. The scope stays under your control: we unroll from the domains you declare, no reckless attribution to entities that aren't yours.

Yes. Public S3 buckets, Azure Blob Storage, GCP Storage, exposed instances, subdomains pointing to a CDN or a cloud host. Dedicated modules also check storage ACLs and metadata leaks (cloud SSRF). If a cloud asset is reachable from the Internet and tied to your domain, it surfaces in the inventory.

You schedule periodic scans (cron) and trigger on-demand scans from the interface or the API. On every pass, you get the delta: new asset, port that opens, new CVE on an exposed service, finding resolved. Volumes depend on the plan: 10 scans a month on Discovery, 100 on Pro, unlimited on Business and Enterprise. You track your usage in real time.

The scan is refused and the API returns an HTTP 402 until the monthly renewal or an upgrade. All quotas (scans, monitored assets, AI validations, API keys) are counted per calendar month and reset on the 1st. The dashboard shows your usage and an upgrade button. Note: the Discovery plan monitors up to 25 assets and 1 domain, the Pro plan goes up to 250 assets and 5 domains, Business up to 1,000 assets and 15 domains.

On a High or Critical finding, you can ask an autonomous AI agent to try to confirm it is actually exploitable. It has real offensive tooling (sqlmap, nuclei and others) that it runs against the affected asset, within strict guardrails: 20 steps, 300 seconds and 150,000 tokens per finding. If it proves exploitability, the finding moves to confirmed with a stored proof (secrets masked). It is AI, not a human pentester, and it is quota-limited: 2 validations a month on Discovery, 30 on Pro, 100 on Business, unlimited on Enterprise. We don't promise zero false positives. For thorough human verification, that's the job of our pentests, a separate offering.

Let's separate two things. EASM discovery and scanning are non-intrusive by design: no exploitation, no destructive payload, redirects disabled, per-host rate capped (1 to 1000 req/s), three-layer anti-SSRF guard. You can add it to your perimeter without coordinating with the ops team. AI validation, on the other hand, is active testing: it runs real tooling against the live asset, which can change its state. The sandbox isolates the tooling (ephemeral container, egress filtered to the target's public IPs only), not your asset. That's why it is manual, reserved for critical findings on a domain you have verified, and quota-limited.

Hosting in the EU. Your inventory data and findings stay under European law, isolated per account (strict per-tenant database partitioning), with secrets masked before they are written. No reselling, no sharing with third parties, no use to train external models. The optional AI validation calls Anthropic's Claude models through Google Cloud Vertex AI in a European region (standard contractual clauses, no training on your data). Handing your entire attack map to a US vendor exposes you to extraterritorial access requests, at odds with GDPR and NIS2: we keep hosting in the EU.

The scope is defined by the root domains you add (1 on Discovery, 5 on Pro, 15 on Business, unlimited on Enterprise): nothing outside is scanned. For each run, you tune custom headers and cookies (up to 50 each) and the maximum per-host rate. Useful to respect a WAF, a load window or a sensitive environment.

Article 21 of NIS2 mandates risk management that includes asset mapping and continuous monitoring of the exposed surface, shadow IT included. EASM addresses this part directly: a live inventory of exposed assets, CVE detection with KEV and EPSS prioritisation, an alert on the first change, PDF and CSV reports exportable for your auditors. To be clear: it doesn't cover all of NIS2 on its own (governance, incident response, supply chain remain on you). It addresses the part about knowing and controlling what you expose.

No minimum term. The subscription is monthly or annual (annual works out at ten months paid), renewed tacitly at each due date, and you cancel it at any time, with no justification to give: either you do it yourself from your billing area, or you write to contact@own2pwn.fr and the answer comes within 24 hours. No notice period to serve: cancellation takes effect at the end of the current billing period, and you keep access until then. In return, that period is not refunded pro rata. That is not a sales promise, it is article 7 of the terms of sale.

No. The Discovery plan opens from the sign-up form, with no payment method: no card to enter, no counter starting after fourteen days. It is not a trial but a free plan with no time limit and its own quotas (1 domain, 25 tracked assets, 10 scans per month). A card only comes into play if you move to a paid plan, and payment happens on own2pwn.fr, by card only.

Access opens immediately after the payment is validated. In practice: as soon as the payment is confirmed, the subscription is attached to your account and the plan quotas apply, with no manual step in between. If you subscribe without an own2pwn account yet, the payment creates one and you get an email to set your password: access is live as soon as that is done. If anything gets stuck, write to contact@own2pwn.fr, the answer comes within 24 hours.

Yes, and without starting over: the account, the domains you declared and the scan history stay in place, only the quotas change. You request the change by email to contact@own2pwn.fr, stating the plan you want and the date it should take effect; the answer comes within 24 hours. What is settled on the billing side is that the period already paid for is not refunded pro rata (article 7 of the terms of sale); the exact amount and the effective date of the new plan are confirmed to you in writing before anything is validated.