Attack Surface

Almost no company has a faithful inventory of what it exposes to the internet. Whatever is left over from a migration, an old campaign, or a vendor who moved on is still out there, answering.

What it measures

Your external footprint, seen from the outside and without credentials — the same way someone who does not know you sees it. Findings come in six types:

• Forgotten subdomain — it answers, but probably nobody maintains it.
• Expired SSL certificate or expiring soon — the second gives you time to act before the site stops opening.
• Open port — exposed to the internet without necessarily needing to be.
• Exposed service — something answering publicly that likely belongs behind a private network.
• Outdated software version — visible from outside, which is exactly how someone looking for an easy target finds it.

How to set it up

1. 1

   Add your assets

   Domains, subdomains, or IP addresses. No protocol and no trailing slash (yourcompany.com, app.yourcompany.com), and IPs in IPv4 format.

2. 2

   Let the scheduled scan run

   It runs periodically on its own. Assets the system discovers by itself show up flagged as Discovered automatically, so you can tell them apart from the ones you added.

3. 3

   Use a manual scan when you have just changed something

   *Scan now* is for confirming a fix without waiting for the next cycle. It has a monthly quota: 4 per month on Growth, 20 on Enterprise, and the screen tells you how many are left.

How to read the result

Findings group by severity — Critical, High, Medium, Low — and each one records when it was first detected and when it was last seen. That pair of dates tells you more than severity alone: a critical finding from yesterday and one that has been open for eight months are different conversations.

Every finding carries a plain-language explanation, with technical detail available but not up front. The scan history shows how many assets were checked and how many new findings each run produced.

What to do with a finding

1. 1

   Fix it in the infrastructure, not on the dashboard

   Close the port, renew the certificate, decommission the subdomain. Marking a finding resolved without fixing it only hides the problem.

2. 2

   Let the scan confirm it

   If the finding is gone, the next run resolves it on its own. You can also mark it manually when you know it is fixed.

3. 3

   Start with expiring certificates

   It is the only finding that warns you before it causes a visible problem. The others describe something already exposed; this one describes something that will break on a known date.