Managed Security

Attack Surface Management

We keep an inventory of everything you expose to the internet, re-check it as it changes, and confirm by hand what an attacker could actually use before it reaches you.

Your external surface changes every time someone creates a DNS record, opens a security group, spins up a preview environment or signs up for a SaaS tool with the company domain. Asset registers lag behind all of it. What an attacker finds first is often the host nobody listed: a forgotten staging API, a CNAME still pointing at a deleted bucket, a login panel meant for the office network only.

We start from your root domains, company names and cloud accounts, and expand outward through certificate transparency logs, passive DNS, WHOIS and ASN records and your own cloud APIs. Discovery is automated; judgement is not. Every new or changed asset is looked at by the same engineers who run our penetration tests, and anything we report comes with a working reproduction and a suggested owner on your side, not a scanner score.

Usually, one of these is true

A customer's security review asks for a list of your internet-facing systems, and nobody can produce one they would sign.
An acquisition, a rebrand or a cloud migration has left domains, IP ranges and accounts that no current team owns.
Your last penetration test turned up hosts outside the agreed scope that nobody on your team recognised.
A bug bounty report or a researcher's email arrived about a subdomain you had forgotten you owned.

What we watch

Discovery runs outward from the seeds you give us. Anything we find that you did not list is confirmed as yours before we probe it beyond passive observation.

Domains and DNS. Root domains and subdomains from certificate transparency, passive DNS and enumeration. The records themselves too: dangling CNAMEs, stray wildcards, weak SPF, DKIM and DMARC, and open zone transfers.
Hosts and services. Every IP and port reachable from the internet, fingerprinted to the service and version behind it. Remote access, databases, message queues, admin consoles and anything answering on a non-standard port.
Cloud exposure. Storage buckets, load balancers, API gateways, serverless endpoints and managed databases across AWS, Azure and Google Cloud, read from your accounts where you grant read-only access and from the outside where you do not.
Web applications. Login pages, staging and preview deployments, exposed .git directories, backup files, debug endpoints and public API documentation. Third-party software is checked for versions with known, working exploits.
Leaked credentials. API keys, tokens and passwords for your systems in public code repositories, package registries, public container images and paste sites, matched back to the system they open.
Takeover and drift. Subdomains pointing at deprovisioned cloud services, SaaS tenants or CDN endpoints that someone else could claim. Plus every change since the last pass: new hosts, newly opened ports, expired or reissued certificates.

How the service runs

It starts with a baseline and settles into a routine: rediscovery, triage by an engineer, and a report of what changed.

Seeds and authorisation. You give us root domains, legal entity names, known IP ranges and cloud accounts, and sign off on what may be actively probed. Anything we later find outside that list waits for your confirmation.
Baseline. The first full discovery pass, reviewed by hand. You get the inventory, the exposures we confirmed, and a list of assets we believe are yours but need you to claim or disown.
Rediscovery. Discovery reruns on the cadence agreed in the scope. Each pass is compared with the last, so the work is driven by what changed rather than by the whole list.
Triage and confirm. An engineer looks at each change and tests what looks exploitable, within the agreed rules. Confirmed findings reach your channel with a reproduction, and criticals arrive within the hour of confirmation.
Periodic review. At each review we walk the inventory with you, retire what was decommissioned, recheck fixed findings, and add seeds for new brands, acquisitions or cloud accounts.

What you get

Asset inventory. A current list of every external domain, host, service and cloud endpoint we attribute to you, with how it was found and who owns it, for your infrastructure and security leads.
Change reports. A short account of what appeared, disappeared or changed since the previous pass, written for the engineer who has to act on it.
Confirmed findings. Each exposure we verified, with a working reproduction, a CWE mapping, a CVSS v4.0 rating and the fix, sent to your channel as it is confirmed.
Attribution queue. Assets we believe belong to you but cannot prove, listed for you to claim or disown, so the inventory stays accurate rather than padded.
Review summary. A written summary at each periodic review of what your surface looks like now and what closed, for a CTO or a customer's security team.

What we need from you

Root domains, brand and product names, subsidiary and legal entity names, and any IP ranges or ASNs registered to you.
A read-only role in each cloud account and DNS provider, if you want our outside view reconciled against what your accounts say exists.
Written authorisation for active testing of confirmed assets, and a list of anything that must only be observed passively, such as systems hosted by a third party.
A security contact and an infrastructure contact who can confirm ownership of newly found assets and receive critical findings.
Notice of changes that move the surface: acquisitions, new brands, domain transfers and cloud migrations.

What we can show you

Triaged by people who test. The engineers watching your surface are the ones who run our penetration tests, and our researchers have published 70+ CVEs. A new host is judged by whether it can be broken, not by a banner match.
Every finding proven. Nothing reaches you on a version string alone. Each exposure comes with a working reproduction, a CWE and a CVSS v4.0 rating, and criticals arrive within the hour of being confirmed.
Your map stays private. An inventory of your exposure is the document an attacker would most want. It sits under mutual NDA, encrypted, limited to the engineers on the engagement, and your name is never disclosed.
Findings become fixes. One team runs testing, hardening and engineering. When an exposure needs a DNS clean-up, a firewall change or a rebuild, the people who found it can do the work without a hand-over.

Standards we work to

Assets are tracked against the inventory controls auditors ask about, and exposures are rated with the same public scales your vulnerability process already uses.

MITRE ATT&CK (Reconnaissance)
CIS Controls v8.1 (Controls 1 and 2)
NIST CSF 2.0 (ID.AM)
CISA Known Exploited Vulnerabilities
CWE
CVSS v4.0

Common questions

How is this different from the external penetration test we already buy?

A penetration test examines a fixed scope over fixed dates, in depth. Attack surface management keeps that scope honest between tests: it finds what was added or forgotten and confirms what is exposed as it appears. The inventory is also the best input for scoping your next penetration test.

Will you actively test assets you discover, or only list them?

Only assets you have confirmed as yours and authorised in writing are actively tested. Anything we attribute to you but cannot prove is observed passively and sits in the attribution queue until you claim it. Systems hosted by a third party are tested only where the provider's terms allow it.

Do we need to install an agent or give you network access?

No. The work is done from the outside, the way an attacker sees you. Read-only access to cloud accounts and your DNS provider is optional; it lets us reconcile what exists against what is reachable, and catch assets that are one configuration change away from exposure.

How do you keep the noise down?

Nothing is reported on a version banner or a scanner signature alone. An engineer confirms each exposure, groups hosts that share the same root cause, and reports it once with every affected asset listed. Informational items go into the inventory, not your alert channel.

What does it cost, and how often do you rediscover?

The seeds in scope, the rediscovery cadence and the depth of confirmation are agreed when we scope the work, then written into the scope with a fixed price and fixed dates for the retained period. The size of your surface and how quickly it changes drive both.

Related services

Tell us about the system in the chat or on the contact page. Yaali, our AI agent, answers first and brings in an engineer.