Platform
Attack surface discovery and shadow IT detection
Attack surface discovery starts from a few facts you give us, such as your domains, IP ranges and company or brand names, and finds everything on the internet that belongs to you. That includes the marketing microsite, the forgotten test server and the cloud service a team set up on a credit card.
You cannot protect what nobody listed
Most breaches of internet-facing systems start with an asset the security team did not know existed: a staging site left online after a project, a subdomain pointing at a retired cloud service, a remote access appliance installed by a supplier. Spreadsheets and CMDBs record what someone remembered to add. Attackers enumerate what is actually there.
Regulators have noticed. Australia's PSPF Requirement 0211 asks entities to identify and manage their internet-facing systems, ASD Essentials puts boundary services in priority phase 1, and Cyber Essentials starts with defining the internet-facing scope. Each of those begins with an accurate inventory.
How EASMLens does it
- 1
Seed
You add your known domains, IP ranges and brand or company names. That is the only input needed, and nothing is installed on your network.
- 2
Discover
EASMLens expands each seed using DNS records, certificate transparency logs and internet-wide scan datasets from Netlas and Censys, finding subdomains, hosts, open services and certificates attributed to you.
- 3
Attribute
Every asset carries an ownership confidence of confirmed, probable or suspected, so your team reviews the uncertain ones instead of trusting a list blindly.
- 4
Map
Relationships are recorded: which domain contains which subdomain, which host it resolves to, what it serves and which certificate secures it. The asset relationship graph shows how an exposure connects to the rest of your estate.
- 5
Repeat
Discovery runs continuously. New assets, removed hosts and changed services are reported as changes, not buried in a fresh list each time.
What it checks
Subdomains
From DNS and certificate transparency, including ones never linked from your website.
Hosts and IP addresses
What each name resolves to, with hosting network and location.
Open services
Ports and services seen in internet-wide data and confirmed by your own scans.
Web applications
Page titles, technologies and server software on every web asset.
Certificates
Every TLS certificate issued for your names, which often reveals hosts DNS does not.
Cloud storage and endpoints
Cloud services attributed to your organisation.
APIs
API endpoints are identified and classified so they can be reviewed separately from websites.
What you get
- A live asset inventory you can filter, export and hand to an auditor
- An ownership confidence on every asset, so review effort goes to the uncertain ones
- A relationship graph from domain to host to service to certificate
- A change log of new and removed assets since the previous scan
- Asset reports in PDF, Word and CSV
Where it helps
- Australia
- Evidence for the internet-facing systems stocktake in PSPF Requirement 0211 and the boundary services domain in ASD Essentials. See EASM in Australia.
- United Kingdom
- Define your real Cyber Essentials boundary before the assessor does. See EASM in the UK.
- Mergers and acquisitions
- See what a target company exposes before you inherit it.
EASMLens discovers your attack surface from DNS, certificate transparency, internet-wide scan datasets and public records, then runs non-destructive checks against the assets in your scope. It never attempts exploitation. It provides discovery, monitoring and evidence. It does not certify an organisation against any framework, and no product can.
Frequently asked questions
- How is attack surface discovery different from an asset inventory tool?
- Inventory tools record what is connected to your network or listed in your systems. Attack surface discovery works from the outside, the way an attacker does, so it finds internet-facing assets nobody recorded, including those run by suppliers and other teams.
- Do we need to install agents or give network access?
- No. Discovery needs only your seeds. Active checks on discovered assets run from our platform over the internet once you have proved ownership of a domain or your organisation is marked trusted.
- What about assets that are not really ours?
- Every asset carries an ownership confidence. You confirm or remove suspected ones, and active checks only run on assets in your approved scope.
- How often does discovery run?
- Continuously, on the schedule set for your workspace, every 12 hours by default. Each run is compared with the previous one so you see what changed.
Related capabilities
External vulnerability scanning
Non-destructive checks on every internet-facing asset you own: exposed services, known vulnerabilities, end-of-life software and risky configurations.
Dangling DNS and subdomain takeover
Find CNAME records pointing at cloud resources that no longer exist, before someone claims the resource and serves content on your subdomain.
Certificate and website monitoring
Catch expired and expiring TLS certificates, sites still on plain HTTP and website quality issues across every web asset you own, not just the main site.