Platform
External attack surface management for MSPs and security consultants
EASMLens gives managed service providers and security consultants a way to offer continuous attack surface management without building it. Each client gets its own workspace, scans run on schedule, and findings arrive as client-ready reports.
Clients ask what they expose, and the honest answer takes a week
Clients increasingly need evidence of their internet-facing estate for insurers, auditors and regulators. Assembling it by hand from DNS exports, scanner runs and certificate searches takes days per client and is out of date when delivered.
Scanning on a client's behalf also carries responsibility. You need proof that you are authorised to test each domain, and a record of who changed the scope and when.
How EASMLens does it
- 1
Create a workspace per client
A platform administrator creates each client organisation with its own users, seeds, asset limit and scan schedule. Client data stays separated.
- 2
Establish authority
Clients publish a DNS TXT record to prove ownership of each domain, or you mark the organisation trusted under your contract. Every change is recorded in the audit log.
- 3
Scan continuously
Discovery and non-destructive checks run on each client's schedule, and Scan Health shows when each workspace last scanned successfully.
- 4
Deliver
Hand clients reports in PDF, Word or CSV, give them their own logins with MFA, and use AI summaries to explain findings in plain language.
What it checks
Per-client discovery
Domains, subdomains, IPs, certificates, cloud services and APIs for each client.
Per-client vulnerability checks
Nmap, Nikto, Nuclei and WPScan against each client's approved scope.
Email security
SPF, DKIM, DMARC and related records for every client domain.
Change detection
New and removed assets and services since the last scan, per client.
What you get
- A workspace per client with its own users, roles and MFA
- Ownership proof and an audit trail for every scope decision
- Client-ready reports in PDF, Word and CSV
- Scan Health per workspace so missed scans are noticed
- Plain-language AI summaries generated on a self-hosted model
Where it helps
- Managed security services
- Add continuous external monitoring to an existing service without new infrastructure.
- Compliance consultants
- Give clients evidence for PSPF 0211, ASD Essentials, Cyber Essentials and CIRMP asset inventories. See the country guides.
- Cyber insurance renewals
- Answer the external exposure questions insurers ask with current data.
EASMLens discovers your attack surface from DNS, certificate transparency, internet-wide scan datasets and public records, then runs non-destructive checks against the assets in your scope. It never attempts exploitation. It provides discovery, monitoring and evidence. It does not certify an organisation against any framework, and no product can.
Frequently asked questions
- Can our clients log in themselves?
- Yes. Each workspace has its own users, and multi-factor authentication is available for every login.
- How do we show we are authorised to scan a client?
- The client publishes a DNS TXT record for each domain, which proves ownership. Alternatively a platform administrator marks the organisation trusted under your contract. Both are recorded in the audit log.
- Where does AI processing happen?
- AI summaries run on a self-hosted model on our own infrastructure. Client scan data is not sent to a third-party AI provider.
- Can we limit how many assets each client uses?
- Yes. Each workspace has an asset limit set by the platform administrator.
Related capabilities
Attack surface discovery
Find every internet-facing domain, subdomain, IP, certificate, cloud service and API attributed to you, including shadow IT nobody told security about.
External vulnerability scanning
Non-destructive checks on every internet-facing asset you own: exposed services, known vulnerabilities, end-of-life software and risky configurations.
Email security monitoring
Monitor SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC, DANE and BIMI across every domain you own, including parked domains attackers spoof.