# Attack surface management | Precursor Intelligence

**See what your business has open to the internet. And what changed since last time.**

> Attack surface management finds everything of yours that anyone online can reach: subdomains, servers, IP addresses, open ports, the services behind them and their certificates. We do it with a scan you start from your browser whenever you like. It is for any business with a website, whether you run IT yourself or lead a security team.

Canonical page: https://www.precursorintelligence.com/features/attack-surface-management
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Features](https://www.precursorintelligence.com/features) > Attack surface management
Start free: https://www.precursorintelligence.com/register · Book a demo: https://www.precursorintelligence.com/contact

Compare any two scans. It never attacks anything. Nothing to install.

Example data on this page uses the fictional company Acme (acme.co.uk, documentation-range IP addresses such as 203.0.113.24).

## Contents

1. [What does a scan find?](#what-does-a-scan-find)
2. [How does a scan work?](#how-does-a-scan-work)
3. [What changed since last time?](#what-changed-since-last-time)
4. [Which machine needs attention first?](#which-machine-needs-attention-first)
5. [Have any staff logins leaked?](#have-any-staff-logins-leaked)
6. [Questions](#questions)
7. [Related features](#related-features)

## What does a scan find?

Give us a domain and the scan works outwards from it, the way someone on the internet would see you. These are the twelve things it records:

1. **Subdomains.** Every name under your domain we can find, such as shop.acme.co.uk or vpn.acme.co.uk.
2. **Hosts and IP addresses.** Each machine those names point to, and the internet addresses it answers on.
3. **Network ranges.** The blocks of internet addresses your hosts sit in, and the organisation each block belongs to.
4. **DNS records.** The public records that point your names at websites, servers and email.
5. **Open ports.** Every door left open to the internet on each host, such as 443 for a website or 5432 for a database.
6. **Running services.** What is answering behind each open port: web servers, mail servers, VPN sign-in pages and more.
7. **SSL/TLS certificates.** The certificates your hosts present, who issued them and when they expire.
8. **Known flaws.** Published vulnerabilities in the services we found, so you know which ones need a patch.
9. **Findings and issues by host.** Everything grouped under the machine it belongs to, so you can work through one host at a time.
10. **Network map.** A picture of how your names, hosts and address ranges connect to each other.
11. **Exposed staff logins.** Email addresses on your domain that appear in other companies' data breaches. See [the leaked staff credentials check](https://www.precursorintelligence.com/features/credential-exposure).
12. **Changes since your last scan.** New and closed hosts, ports and services, when you compare two scans.

## How does a scan work?

There is nothing to install and no agent on your network. The scan looks at what is already public about your domain, and never tries to break in.

1. **Prove the domain is yours (once per domain).** Add your domain, then confirm you own it with a DNS record (for example a TXT record at `_precursor-verify.acme.co.uk`), through Cloudflare, with your work email address or by asking our team to review it.
2. **Start a scan (whenever you like).** Pick the domain and start. We map what it exposes to the internet. Nothing is attacked and nothing is installed.
3. **Work through the results (when it finishes).** See every host with its open ports, services, certificates and known flaws, grouped by machine and drawn as a network map.
4. **Compare and share (next time).** Run it again later and compare any two scans to see what appeared and what has gone. Export either as a PDF.

## What changed since last time?

**Scan comparison.** A server set up for a quick test, a database port opened for a fix: changes like these are easy to miss. Pick two scans of the same domain and we show what appeared and what has gone.

- New hosts, ports and services are marked as new, so the risky additions stand out.
- Hosts that are no longer reachable show as gone, so you can confirm a clean-up worked.
- Export the comparison as a PDF to share with whoever made the change.

Scans do not repeat by themselves. Run one whenever something changes, such as a new website or a move to a new host, and compare it with the last.

Example (Acme, scan of 2 September compared with 16 October): + 203.0.113.24:5432, a database port now reachable from the internet; + staging.acme.co.uk, a new host running a web server with a known flaw; + shop.acme.co.uk, a new host; − ftp.acme.co.uk, no longer reachable.

## Which machine needs attention first?

**Hosts, ports and services.** Every finding is grouped under the host it belongs to, with the ports it has open, the service answering on each one and any known flaws in those services.

- Known flaws in the services we find, such as an exploited flaw in a VPN gateway.
- Each host's IP address and open ports, and what is running behind every one.
- A network map of how your names, hosts and address ranges connect.
- Ask your AI assistant about it: our [MCP server](https://www.precursorintelligence.com/features/mcp-server) gives assistants such as Claude your hosts, ports, services and certificates.

A scan sees what is visible from the internet. For the software you run inside, tell us what it is and track it with [vulnerability management](https://www.precursorintelligence.com/features/vulnerability-management).

Example (Acme): vpn.acme.co.uk (203.0.113.10) has ports 443 and 4501 open and a known exploited VPN gateway flaw, CVE-2024-3400; staging.acme.co.uk runs an older web server version with a known flaw; mail.acme.co.uk has a medium-risk mail server flaw, CVE-2023-42116; www.acme.co.uk has no known flaws.

## Have any staff logins leaked?

**Exposed staff logins.** Every scan also looks for email addresses on your domain that turn up in other companies' data breaches, so you know who should change their password.

- Each affected address, with how many records leaked, how many people and which breaches they came from.
- How many leaked passwords are readable, so you can start with the accounts most at risk.
- The passwords themselves are never shown. You see who is affected, not their secrets.
- Checked each time a scan runs, rather than watched continuously.

Part of every scan, with nothing extra to set up. More on [the leaked staff credentials check](https://www.precursorintelligence.com/features/credential-exposure).

## Questions

### Does a scan attack my systems?

No. It maps what your domain exposes to the internet and does not attack anything. It is discovery and exposure mapping, not a penetration test.

### How often does it scan?

Whenever you start one. Run a scan whenever you like, for example after something changes such as a new website, and compare it with the last one.

### Can I scan any domain?

Only domains you have shown are yours. Confirm ownership with a DNS record, through Cloudflare, with a work email address on that domain, or by asking our team to review it.

### Can I get the results into my own tools?

Yes. Export any scan or comparison as a PDF. With an API key that has organisation access, the REST API returns a whole scan and the changes between scans, and AI assistants can ask our MCP server for your hosts, ports, services and certificates.

### Will it tell me about leaked staff passwords?

Each scan checks for email addresses on your domain that appear in other companies' data breaches. You see who is affected and whether a readable password leaked, never the password itself. It is checked when a scan runs, not continuously.

## Related features

- [Leaked staff credentials check](https://www.precursorintelligence.com/features/credential-exposure): find staff email addresses that appear in other companies' data breaches, without the passwords ever being shown.
- [SSL certificate monitoring](https://www.precursorintelligence.com/features/ssl-certificate-monitoring): get a warning before your own SSL certificates expire, with every domain's certificate in one place.
- [Vulnerability management](https://www.precursorintelligence.com/features/vulnerability-management): tell us the software you run and see only the known flaws that affect it.
- [MCP server](https://www.precursorintelligence.com/features/mcp-server): ask Claude, Cursor or any MCP assistant about your own estate and current threats, with real data behind the answer.
- [All features](https://www.precursorintelligence.com/features)

## Get started

Know what you have online, and what changed. See every subdomain, host, open port and certificate anyone online can reach, which staff logins have leaked, and what changed since your last scan. Nothing is attacked.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact
- Nothing to install · Unlimited team members · Data stored in London · Two-factor sign-in for everyone