Attack Surface

It is everything your organisation exposes on the Internet that an attacker can reach without prior access: subdomains, IPs and ASN ranges, open ports and services, TLS certificates, web applications, admin interfaces, cloud storage across S3, Azure or GCP. The catch is that this surface always spills over the official inventory: staging left online, a bucket created off-process, a subsidiary's asset, a forgotten subdomain. The Attack Surface module starts from a single root domain and reconstructs that real perimeter, not the one you think you have.

You enter your root domain, the scan starts. No agent to install, no cloud access to provide. We combine 14 discovery plugins: passive sources (Certificate Transparency via crt.sh, six public subdomain sources, WHOIS and reverse WHOIS, DNS), then non-intrusive active steps (port scanning, service fingerprinting, vhost enumeration, web crawling, cloud detection for S3/Azure/GCP). Step by step, we pull up subdomains, IPs, ports, TLS certificates, technologies and exposed services. The scope stays under your control: we unroll from the domains you declare, no reckless attribution to entities that aren't yours.

Yes. Public S3 buckets, Azure Blob Storage, GCP Storage, exposed instances, subdomains pointing to a CDN or a cloud host. Dedicated modules also check storage ACLs and metadata leaks. If a cloud asset is reachable from the Internet and tied to your domain, it surfaces in the inventory just like the rest of your surface.

You schedule periodic scans (cron) and trigger on-demand scans from the interface or the API. On every pass, you get the delta: new asset, port that opens, new CVE on an exposed service, finding resolved. Volumes depend on the plan: 10 scans a month on Discovery, 100 on Pro, unlimited on Business and Enterprise. You track your usage in real time.

A grade from A to F that sums up the state of your attack surface from the discovered assets and open findings, weighted by severity. It serves two purposes: giving an immediate read to a non-technical audience (the board, an auditor) and tracking a trajectory over time, to see whether your surface improves after a remediation effort or drifts as new assets appear. It is not a compliance grade, it is an exposure indicator.

An isolated finding doesn't tell you much. The graph links your assets and findings together (shared certificates, DNS records, cloud relationships) to reconstruct exploitation chains: this subdomain leads to this service, which shares a certificate with that other asset. Each path is ranked by severity, with a blast radius measuring what falls behind a compromised asset. You prioritise on what actually leads somewhere, not on a flat list of CVEs.

Discovery and mapping are non-intrusive by design: no exploitation, no destructive payload, redirects disabled, per-host rate capped (adjustable from 1 to 1000 req/s), three-layer anti-SSRF guard. You can add it to your perimeter without coordinating a maintenance window with the ops team. For each run, you also tune custom headers, cookies and the maximum per-host rate, useful to respect a WAF or a sensitive environment.

Article 21 of NIS2 mandates risk management that includes asset mapping and continuous monitoring of the exposed surface, shadow IT included. The Attack Surface module addresses this part directly: a live inventory of exposed assets, change detection, a CyberScore to track the trajectory, PDF and CSV reports exportable for your auditors. To be clear: it doesn't cover all of NIS2 on its own (governance, incident response, supply chain remain on you). It addresses the knowing and controlling what you expose part.