Attack Surface

It is everything your organisation exposes on the Internet that an attacker can reach without prior access: subdomains, IPs and ASN ranges, open ports and services, TLS certificates, web applications, admin interfaces, cloud storage across S3, Azure or GCP. The catch is that this surface always spills over the official inventory: staging left online, a bucket created off-process, a subsidiary's asset, a forgotten subdomain. The Attack Surface module starts from a single root domain and reconstructs that real perimeter, not the one you think you have.

You enter your root domain, the scan starts. No agent to install, no cloud access to provide. We combine 14 discovery plugins: passive sources (Certificate Transparency via crt.sh, six public subdomain sources, WHOIS and reverse WHOIS, DNS), then non-intrusive active steps (port scanning, service fingerprinting, vhost enumeration, web crawling, cloud detection for S3/Azure/GCP). Step by step, we pull up subdomains, IPs, ports, TLS certificates, technologies and exposed services. The scope stays under your control: we unroll from the domains you declare, no reckless attribution to entities that aren't yours.

Yes. Public S3 buckets, Azure Blob Storage, GCP Storage, exposed instances, subdomains pointing to a CDN or a cloud host. Dedicated modules also check storage ACLs and metadata leaks. If a cloud asset is reachable from the Internet and tied to your domain, it surfaces in the inventory just like the rest of your surface.

You schedule periodic scans (cron) and trigger on-demand scans from the interface or the API. On every pass, you get the delta: new asset, port that opens, new CVE on an exposed service, finding resolved. Volumes depend on the plan: 10 scans a month on Discovery, 100 on Pro, unlimited on Business and Enterprise. You track your usage in real time.

A grade from A to F that sums up the state of your attack surface from the discovered assets and open findings, weighted by severity. It serves two purposes: giving an immediate read to a non-technical audience (the board, an auditor) and tracking a trajectory over time, to see whether your surface improves after a remediation effort or drifts as new assets appear. It is not a compliance grade, it is an exposure indicator.

An isolated finding doesn't tell you much. The graph links your assets and findings together (shared certificates, DNS records, cloud relationships) to reconstruct exploitation chains: this subdomain leads to this service, which shares a certificate with that other asset. Each path is ranked by severity, with a blast radius measuring what falls behind a compromised asset. You prioritise on what actually leads somewhere, not on a flat list of CVEs.

Discovery and mapping are non-intrusive by design: no exploitation, no destructive payload, redirects disabled, per-host rate capped (adjustable from 1 to 1000 req/s), three-layer anti-SSRF guard. You can add it to your perimeter without coordinating a maintenance window with the ops team. For each run, you also tune custom headers, cookies and the maximum per-host rate, useful to respect a WAF or a sensitive environment.

Article 21 of NIS2 mandates risk management that includes asset mapping and continuous monitoring of the exposed surface, shadow IT included. The Attack Surface module addresses this part directly: a live inventory of exposed assets, change detection, a CyberScore to track the trajectory, PDF and CSV reports exportable for your auditors. To be clear: it doesn't cover all of NIS2 on its own (governance, incident response, supply chain remain on you). It addresses the knowing and controlling what you expose part.

No minimum term. The subscription is monthly or annual (annual works out at ten months paid), renewed tacitly at each due date, and you cancel it at any time, with no justification to give: either you do it yourself from your billing area, or you write to contact@own2pwn.fr and the answer comes within 24 hours. No notice period to serve: cancellation takes effect at the end of the current billing period, and you keep access until then. In return, that period is not refunded pro rata. That is not a sales promise, it is article 7 of the terms of sale.

No. The Discovery plan opens from the sign-up form, with no payment method: no card to enter, no counter starting after fourteen days. It is not a trial but a free plan with no time limit and its own quotas (1 domain, 25 tracked assets, 10 scans per month). The Attack Surface module is included in it, not sold separately. A card only comes into play if you move to a paid plan, and payment happens on own2pwn.fr, by card only.

Access opens immediately after the payment is validated. In practice: as soon as the payment is confirmed, the subscription is attached to your account and the plan quotas apply, with no manual step in between. If you subscribe without an own2pwn account yet, the payment creates one and you get an email to set your password: access is live as soon as that is done. If anything gets stuck, write to contact@own2pwn.fr, the answer comes within 24 hours.

Yes, and without starting over: the account, the domains you declared and the scan history stay in place, only the quotas change. Modules are never billed separately: Attack Surface comes with the EASM subscription, so changing plan moves the quotas of every module at once. You request the change by email to contact@own2pwn.fr, stating the plan you want and the date it should take effect; the answer comes within 24 hours. What is settled on the billing side is that the period already paid for is not refunded pro rata (article 7 of the terms of sale); the exact amount and the effective date of the new plan are confirmed to you in writing before anything is validated.