See what your business has open to the internet. And what changed since last time.
Attack surface management finds everything of yours that anyone online can reach: subdomains, servers, open ports, the services behind them and their certificates. Start a scan from your browser whenever you like.
What does a scan find? Here is the full list.
Give us a domain and the scan works outwards from it, the way someone on the internet would see you. These are the twelve things it records.
Subdomains
Every name under your domain we can find, such as shop.acme.co.uk or vpn.acme.co.uk.
Hosts and IP addresses
Each machine those names point to, and the internet addresses it answers on.
Network ranges
The blocks of internet addresses your hosts sit in, and the organisation each block belongs to.
DNS records
The public records that point your names at websites, servers and email.
Open ports
Every door left open to the internet on each host, such as 443 for a website or 5432 for a database.
Running services
What is answering behind each open port: web servers, mail servers, VPN sign-in pages and more.
SSL/TLS certificates
The certificates your hosts present, who issued them and when they expire.
Known flaws
Published vulnerabilities in the services we found, so you know which ones need a patch.
Findings and issues by host
Everything grouped under the machine it belongs to, so you can work through one host at a time.
Network map
A picture of how your names, hosts and address ranges connect to each other.
Exposed staff logins
Email addresses on your domain that appear in other companies' data breaches.
Changes since your last scan
New and closed hosts, ports and services, when you compare two scans.
How does a scan work? Four steps, all in your browser.
There is nothing to install and no agent on your network. The scan looks at what is already public about your domain, and never tries to break in.
- Once per domain
Prove the domain is yours
Add your domain, then confirm you own it with a DNS record, through Cloudflare, with your work email address or by asking our team to review it.
- Whenever you like
Start a scan
Pick the domain and start. We map what it exposes to the internet. Nothing is attacked and nothing is installed.
- When it finishes
Work through the results
See every host with its open ports, services, certificates and known flaws, grouped by machine and drawn as a network map.
- Next time
Compare and share
Run it again later and compare any two scans to see what appeared and what has gone. Export either as a PDF.
What changed since last time? Compare any two scans.
A server set up for a quick test, a database port opened for a fix: changes like these are easy to miss. Pick two scans of the same domain and we show what appeared and what has gone.
- New hosts, ports and services are marked as new, so the risky additions stand out.
- Hosts that are no longer reachable show as gone, so you can confirm a clean-up worked.
- Export the comparison as a PDF to share with whoever made the change.
Scans do not repeat by themselves. Run one whenever something changes, such as a new website or a move to a new host, and compare it with the last.
Scan compare · PDF export
Which machine needs attention first? Work host by host.
Every finding is grouped under the host it belongs to, with the ports it has open, the service answering on each one and any known flaws in those services.
- Known flaws in the services we find, such as an exploited flaw in a VPN gateway.
- Each host's IP address and open ports, and what is running behind every one.
- A network map of how your names, hosts and address ranges connect.
- Ask your AI assistant about it. Our MCP server gives assistants such as Claude your hosts, ports, services and certificates.
A scan sees what is visible from the internet. For the software you run inside, tell us what it is and track it with vulnerability management.
Hosts · Ports · Services · Vulnerabilities · Network map
acme.co.uk · Pick a host to see what it exposes
vpn.acme.co.uk203.0.113.10
Open ports and services
- 443HTTPS · VPN sign-in page
- 4501VPN tunnel
Known flaws on these services
- VPN gateway flawCVE-2024-3400Known exploited
Example data for a fictional company. Four hosts are listed. The VPN host has a known exploited flaw in its VPN service; the staging host runs a web server with a known flaw; the mail host has a medium-risk mail server flaw; the main website has no known flaws.
Have any staff logins leaked? Each scan checks.
Every scan also looks for email addresses on your domain that turn up in other companies' data breaches, so you know who should change their password.
- Each affected address, with how many records leaked, how many people and which breaches they came from.
- How many leaked passwords are readable, so you can start with the accounts most at risk.
- The passwords themselves are never shown. You see who is affected, not their secrets.
- Checked each time a scan runs, rather than watched continuously.
Part of every scan, with nothing extra to set up. More on credential exposure
Exposed credentials · Part of every scan
No. It maps what your domain exposes to the internet and does not attack anything. It is discovery and exposure mapping, not a penetration test.
Whenever you start one. Run a scan whenever you like, for example after something changes such as a new website, and compare it with the last one.
Only domains you have shown are yours. Confirm ownership with a DNS record, through Cloudflare, with a work email address on that domain, or by asking our team to review it.
Yes. Export any scan or comparison as a PDF. With an API key that has organisation access, the REST API returns a whole scan and the changes between scans, and AI assistants can ask our MCP server for your hosts, ports, services and certificates.
Each scan checks for email addresses on your domain that appear in other companies' data breaches. You see who is affected and whether a readable password leaked, never the password itself. It is checked when a scan runs, not continuously.
Know what you have online. And what changed.
See every subdomain, host, open port and certificate anyone online can reach, which staff logins have leaked, and what changed since your last scan. Nothing is attacked.