External attack surface monitoring
Know the moment your attack surface changes.
Attack Surface Scan checks the outside of the systems you already run (certificates, security headers, DNS, and what is listening), then keeps checking, and tells you when something moves. New subdomains, expiring certificates, ports that opened overnight. No agent to install, no code to change.
No card required to start. Plans from $25/month; cancel any time.
One score to watch, a report you can hand to anyone
The dashboard shows your posture and what moved since last scan. Every scan can also be exported as a branded PDF, ready for a client, a boss, or an auditor without editing a thing.
What gets checked
HTTP security headers
HSTS, CSP and frame-ancestors, X-Content-Type-Options, Referrer-Policy, permissive CORS, cookie flags, and whether http quietly serves content instead of redirecting.
TLS and certificates
Chain validity and trust, how close expiry is, negotiated protocol, whether TLS 1.0/1.1 still answer, key strength, and hostname/SAN coverage, on port 443 and any mail or custom ports you list. A short-lived certificate still served past the point automation would have renewed it is called out as a stalled renewal.
DNS and subdomains
SPF and DMARC policy strength, MTA-STS and TLS-RPT for domains that receive mail, CAA, and subdomain discovery from certificate transparency logs, including dangling CNAMEs pointing at services someone else could claim.
Fingerprint and exposed services
What your stack tells the world about itself, plus a TCP connect check of common ports to flag anything answering that should not be.
Findings are scored from critical down to informational and rolled up into a single 0–100 posture number, so you can tell at a glance whether last week's change made things better or worse.
And then it keeps watching
A one-off scan tells you what is wrong today. Infrastructure drifts, so Attack Surface Scan re-checks on a schedule and tells you what moved, which is the part you cannot get by running a tool once.
New subdomains nobody told you about
Preview deployments, contractor microsites and forgotten staging boxes appear in certificate transparency logs the moment they get a cert. We read the logs every 15 minutes, so you find out within the quarter hour, and the new host joins your monitoring on its own.
Certificates before they expire
The served certificate is re-checked up to four times a day, with renewal warnings at 30, 14, 7 and 3 days and a stalled-renewal alert weeks earlier. A certificate issued for your domain by a CA you have not authorized goes to an unknown-certificate queue and alerts at once.
DNS that changed when it shouldn't have
An unexpected NS or MX change is what account takeover looks like from the outside. An SPF record that quietly got broader is how spoofing starts.
Services that appeared overnight
A database port answering the internet is worth knowing about today, not next quarter.
Domains that look like yours
Typosquats and homoglyph registrations are the raw material for phishing and invoice fraud. Watched with public DNS and CT data only.
Your own registration lapsing
A domain that expires is worse than any misconfiguration. We track the registry record and warn you well ahead.
Critical changes are sent the moment they are found; everything else is batched into one weekly digest. Findings you have already dealt with can be muted or accepted with a review date, so the digest stays short enough to keep reading.
+ v=spf1 include:_spf.google.com -all
How it works
Add your domain
Takes about a minute: no agent to install, no code to change.
Attack Surface Scan checks it
The first scan finishes in about a minute, then re-runs on a schedule so you hear about changes, not snapshots.
Get findings you can act on
Every finding has a severity, the evidence behind it, and the specific change that fixes it.
Attack Surface Scan + AI
Your AI already works here
Attack Surface Scan meets your AI where it is. Every scan hands its fixes to a coding agent as a paste-ready prompt, and the hosted MCP server lets your assistant run Attack Surface Scan itself: scans, changes, triage and reports, straight from chat.
Hand the fixes to your coding agent
Most findings are small config changes that live in a repository: exactly what coding agents are built for. One click turns any scan into a hand-off pair: the PDF report plus a paste-ready prompt listing every open finding with its evidence, the suggested fix, and the verification step the agent must state before calling it done. Works with Claude Code, Codex, opencode or whatever agent you run.
Severity-ordered, evidence inline
The prompt lists findings worst-first with the scanner's evidence, so the agent spends its effort where it matters, and findings you've muted or accepted are left out.
Honest about what's not in the repo
Fixes that live at the registrar or in a hosting console come back as a flagged checklist with the exact change to make, instead of a hallucinated file edit.
Verified from the outside
Every finding carries a verification command. You review the diff, deploy, run the checks, and the next scan confirms the score moved.
The full hand-off prompt is included with every paid plan; the free trial shows a one-finding preview. How the workflow plays out in Claude Code, Codex and opencode is covered in the hand-off guide.
Or just ask: the MCP server
Connect Claude, ChatGPT, Codex or any MCP client to your account and your attack surface becomes something you can question.
The whole product as tools
Eighteen tools cover the workflow end to end: scan, findings, change feed, triage, PDF reports, and client workspaces with white-label branding on MSP plans.
high: the TLS certificate on api.example.com expires in 12 days, and it hasn't changed since May, so renewal automation may have stalled.
medium: the domain registration for example.io lapses in 24 days (Namecheap).
Endpoint and step-by-step setup for Claude, ChatGPT, Codex, Hermes, Manus, OpenClaw and other clients in the MCP server guide.
Evidence for your next audit
SOC 2 and ISO 27001 auditors don't just ask whether you monitor your external infrastructure. They ask you to prove it operated all year. Attack Surface Scan produces that proof as a side effect of running: scheduled scans with full history, an alert trail, and dated PDF reports you can hand over as-is.
SOC 2
The Common Criteria expect you to monitor infrastructure for vulnerabilities and configuration change (CC7.1) and to evaluate that monitoring (CC4.1). A year of scheduled scans, alerts, and resolved findings is that control operating, across the whole audit period and not just the week before fieldwork.
ISO 27001
Annex A 8.8 asks how you manage technical vulnerabilities and A.5.7 asks where your threat intelligence comes from. Scan history plus CT-log subdomain discovery and lookalike-domain watching answer both with dated records instead of a described process.
Security questionnaires
“Do you perform external vulnerability scanning?” appears on nearly every vendor review. Attach last week's PDF (scope, findings, severities and date on the first page) instead of writing a paragraph an assessor has to take on faith.
Point-in-time proof
Every scan is kept, and any of them exports as a branded, dated PDF. When an auditor asks what your posture was in March, you send March's report rather than reconstructing it.
Honest scoping: Attack Surface Scan is monitoring evidence for a handful of controls, not a compliance program. It does not replace a penetration test, and it is not a PCI ASV scan. It covers the "continuous external monitoring" row of your controls matrix, and covers it well. Full control-by-control mapping in the audit evidence guide.
Run security for clients? Put your name on it.
MSPs and agencies answer for their clients' security every day. The MSP plan puts the same continuous monitoring behind your brand: every client estate in one console, reports carrying your logo, alerts routed per client into your ticketing, and one flat price: $149/month across 25 domains.
Frequently asked questions
What is external attack surface monitoring?
External attack surface monitoring (also called EASM) is the practice of continuously checking what your organization exposes to the public internet (domains, subdomains, TLS certificates, DNS records, HTTP security headers and open ports) and alerting you when something changes. Unlike a vulnerability scanner, it looks at your infrastructure the way an outside attacker would: from the internet, with no credentials and no agent installed.
Does Attack Surface Scan require installing an agent or changing code?
No. Attack Surface Scan is entirely external and passive. You add a domain and Attack Surface Scan observes only what is already visible from the public internet: HTTP response headers, the TLS handshake, public DNS, certificate transparency logs, and whether common ports accept a connection.
Is scanning with Attack Surface Scan safe for production systems?
Yes. Every check is passive: Attack Surface Scan reads headers, completes a normal TLS handshake and queries public DNS, the same traffic any browser or mail server generates. There is no fuzzing, no exploitation, no authentication attempts and no load testing, so it cannot disrupt a production system.
Can I scan any domain with Attack Surface Scan?
No, only domains you control. Each domain passes a quick ownership check before any scan runs. Attack Surface Scan is deliberately built so it cannot be pointed at someone else's infrastructure.
How is Attack Surface Scan different from a one-off scanner like SSL Labs or Security Headers?
Free graders like Qualys SSL Labs or securityheaders.com give you an excellent snapshot of one thing at one moment. Attack Surface Scan runs those categories of checks together (TLS, headers, DNS, email authentication, exposed services and subdomain discovery) on a schedule, keeps history, and alerts you when something changes. The change detection is the part a one-off scan cannot give you.
Can Attack Surface Scan reports be used as evidence for SOC 2 or ISO 27001?
Yes, as evidence that you continuously monitor your external attack surface, which is what SOC 2 CC7.1 and ISO 27001 Annex A 8.8 ask for. Attack Surface Scan keeps every scheduled scan and alert, and any scan exports as a dated PDF, so you can show the control operating across the whole audit period. It complements rather than replaces a penetration test, and it is not a PCI ASV scan.
Can a coding agent like Claude Code fix Attack Surface Scan's findings?
Yes. Most external findings are small config changes that live in a repository, which is exactly what coding agents handle well. Every completed scan has a one-click hand-off that downloads the PDF report and generates a paste-ready prompt for Claude Code, Codex, opencode or any other agent: findings sorted by severity with evidence and suggested fixes, plus a verification step per finding. Fixes that live outside the repo (registrar DNS, a hosting console) come back as a flagged checklist for a human.
Can I connect Attack Surface Scan to Claude or ChatGPT?
Yes. Attack Surface Scan ships a hosted MCP server at mcp.attacksurfacescan.com/mcp that works with Claude, ChatGPT (developer mode), OpenAI Codex, Claude Code, Cursor, Hermes, Manus, OpenClaw and any other MCP client that supports remote servers. The connection uses standard OAuth (no API keys) and the assistant can run scans, read findings, watch the change feed, triage and generate reports, only against domains your account has verified. Setup guide →
Can MSPs or agencies offer Attack Surface Scan to their clients?
Yes. The MSP plan ($149/month) is built for exactly that: monitor every client estate from one console, put your own logo and name on the PDF reports your clients receive, group domains into client workspaces, and route each client's alerts to their own channel. It covers 25 domains with unlimited scans and daily scheduled scanning. See the MSP page for details.
How much does Attack Surface Scan cost?
Plans start at $25/month, with two months free on annual billing. Every plan starts with a 7-day free trial and no card is required to begin. See the pricing page for what each plan includes.
Latest from the blog
Comparisons, how-tos and plain-language explainers on what the outside world can see about your infrastructure.
Microsoft 365 Was Down for 67 Hours. Admins Traced It to an Expired Certificate.
From August 31 to September 3, 2026, Exchange Online, Teams and SharePoint failed worldwide. Microsoft blamed a core authentication configuration; admins saw an expired certificate thumbprint in the errors. What to check on your own domains.
Read article →Attack Surface Scan vs. Cert Spotter: Certificate Monitoring Compared
Cert Spotter and Attack Surface Scan both watch certificate transparency and the certificate each host serves. Where they match, where Cert Spotter is ahead, where Attack Surface Scan goes further, and how the two price.
Read article →CISA Adds Seven Exploited Flaws in One Day. Two Score a Perfect 10, All Sit on Internet-Facing Software.
On September 2, 2026 CISA added seven actively exploited CVEs to its KEV catalog, including a CVSS 10 SonicWall SMA 1000 flaw and a CVSS 10 Kestra bug. Under BOD 26-04, publicly exposed assets get three days. How to know what you expose.
Read article →One in Five New Domain Registrations Is Someone's Expired Domain, and Criminals Are Paying Millions for Them
Infoblox Threat Intel found about 65,000 expired domains re-registered every day in the first half of 2026, and one actor, Sable Squirrel, holding 10,000 of them for malware C2, gambling and piracy. Why your lapsed domains are an attack surface.
Read article →AWS Defaults Leave Your Attack Surface Exposed: What CloudFront + S3 Ships Without
A default CloudFront + S3 deployment ships with no HSTS, no CSP, no clickjacking protection and a Server header that names your stack. What an external scan finds, and the one policy that fixes most of it.
Read article →The Best DMARC Monitoring Tools in 2026 (Free and Paid)
The best DMARC monitoring tools compared: free analyzers from Postmark and Cloudflare, paid platforms like dmarcian and EasyDMARC, and open source parsedmarc.
Read article →Find out what is exposed.
Add your domain and have your first report in a couple of minutes.
Start your 7-day trial