External attack surface management
See your company the way attackers do.
Add a domain. Attack Surface Scan finds everything you have on the internet, watches it every day, and puts the problems attackers are using right now at the top.
No card required. Nothing to install. From $25/month, flat.
- › add_domain example.com
- › verify ownership ✓
- › discover · 23 systems ✓
- › check certificates, email, services ✓
- ✗ db.example.com · open to the internet
- ! shop.example.com · exploited in the wild
- › report ✓ ready
First report in minutes. Then it keeps watching.
Every check, on every plan.
Plans differ on how many domains are watched and how often, never on what gets looked at. No agents, no network access and no attack traffic: it only reads what the internet can already see, under domains you have proven you own.
Your full inventory
Every internet-facing system under your domains, found from public sources, with where each one is hosted.
Exploited right now
Weaknesses in the software you run, ranked by whether attackers are using them today, so you fix the few that matter.
Exposed services
Databases, remote-access tools and admin consoles that should never answer the internet. You hear about it that morning.
Certificates
Expiring and misconfigured certificates, and any certificate issued for your name by someone you did not authorise.
Email impersonation
Whether your domains can be used to send convincing fake email to your customers, staff or suppliers.
Lookalike domains
New registrations built to phish your customers or staff, watched from public records only. On Growth and above.
Domain ownership
Registrations about to lapse, and domains that could be transferred away without an extra check.
Reputation and privacy
Blocklist listings that usually mean a compromise, plus forms and tracking that leak visitor data.
Findings are ranked from critical to informational and rolled up into a single 0 to 100 posture score. The engineer's version of this list, check by check, is in the checks reference.
Set up in one minute.
Most teams have their first report within minutes of signing up.
Add your domain
Takes about a minute. Prove you own it with one of four simple methods; your IT team will know which suits.
It checks everything under it
The first report is ready in minutes, then it re-checks on a schedule so you hear about changes, not snapshots.
Your team gets a short list
Every finding has a severity, the evidence behind it and the specific fix, ranked so the urgent items are at the top.
Handing this to your IT team? Getting started walks them through it.
Hear about it the morning it happens.
Your estate changes every week. Attack Surface Scan re-checks on a schedule and tells you what moved: a forgotten server, a certificate that stopped renewing, a database that started answering the internet.
Urgent changes are sent the moment they are found; everything else arrives as one weekly digest. Accepted risks are recorded with a reason and a review date, so the digest stays short and the decision is on file for the auditor.
Evidence your auditor will accept.
Dated reports and an evidence pack that show monitoring ran all year, mapped to the SOC 2 and ISO 27001 controls your auditor asks about and the questions on your insurer's form.
Honest scoping: this is monitoring evidence for a handful of controls, not a compliance program, a penetration test or a PCI ASV scan. Control-by-control mapping is in the audit evidence guide; in a SOC 2 Type 2 window? See SOC 2 evidence.
Attack Surface Scan + AI
Ask your assistant. It runs the scan.
Connect Claude, ChatGPT, Codex or Cursor to your account and ask what is expiring, what changed this week, or for a client's branded report. Same permissions and ownership rules as the app. Every report also hands its fixes to your coding agent as a ready-made prompt.
Done. Posture is 82, up 4 since last week. Acme's white-label PDF is ready to download.
For MSPs, vCISOs and agencies
Run security for clients? Put your name on it.
Every client estate in one console, and every report goes out under your brand: your logo, your name, your color, your website in the footer. Our name never appears on the page.
- 25 verified domains across your clients, 250 hosts each
- Client workspaces with per-client alert routing
- White-label PDF reports, daily scans, 25 team seats
Defender EASM bills per asset. We don't.
With metered pricing, every forgotten server that discovery turns up makes the bill bigger. Ours is one flat monthly price per plan, with no sales call to get a quote.
Where the big platforms go further: internet-wide scan history collected over years, discovery that starts from a company name rather than a domain, and deep ties into their own security suites. If you need those, they are the right choice. Full comparison →
Microsoft's published list rate of $0.011 per asset per day, about $0.33 a month. Asset counts are illustrative; the arithmetic is in our pricing breakdown.
For procurement and vendor review
The answers your vendor review will ask for.
Short answers to the questions procurement, legal and IT security ask before approving a new security vendor. The detail behind each is linked.
What we access
Only what is already public, and only under domains you have proven you own.
- Read-only: we look, we never change anything.
- No agents, credentials, VPN or internal network access.
- No logins, attack traffic or load testing.
- Ownership is re-confirmed regularly; checking stops if the proof is removed.
- Our scanner identifies itself to your systems, so your team can recognise it.
Security and data handling
We hold findings about your public systems and the account details you give us.
- Hosted on AWS in the United States (N. Virginia).
- Encrypted in transit and at rest; every customer's data is partitioned by account.
- Two processors only, one for hosting and one for payments, both named in the privacy policy.
- No advertising trackers. We never sell your data or your findings.
- Reports deleted automatically after a year; everything deleted within 30 days of closing your account.
Security questionnaires
Send your vendor security questionnaire to sales@attacksurfacescan.com and a person will complete it. The technical answers most reviewers need (what we scan, how, from which public data sources) are already published in the documentation, and suspected misuse reaches us at security@attacksurfacescan.com.
Billing and contract
- Monthly or yearly; yearly is two months free.
- Pay by card or another common payment method at checkout. We never see or store card numbers.
- 7-day trial of the Starter plan, no card required.
- No overage charges: limits are enforced, never billed.
- Upgrade, downgrade or cancel yourself; cancellation takes effect at the end of the paid period.
- At least 30 days' notice of any price change.
- Single sign-on (SAML or OIDC) on MSP and Enterprise, set up yourself from the Team page.
- Enterprise: custom terms, unlimited domains and a countersigned authorization-to-scan agreement, through sales.
Frequently asked questions.
What is external attack surface management?
External attack surface management (EASM) is the practice of continuously finding and checking everything your organization exposes to the public internet (websites, forgotten systems, certificates, email settings, exposed services) and alerting you when something changes or becomes risky. It looks at your organization the way an outside attacker would: from the internet, with no credentials and nothing installed.
Do we need to install anything or give you network access?
No. There are no agents, appliances or code changes, and no access to your internal network. Attack Surface Scan only looks at what is already public. You prove you own a domain and it starts checking.
Is it safe to run against production systems?
Yes. Every check is read-only and behaves like an ordinary visitor. There are no login attempts, no attack traffic and no load testing, so it cannot disrupt a production system. The full list of what it does and never does is in the documentation.
Can it be pointed at systems we do not own?
No. Each domain passes an ownership check before anything is checked, that proof is re-confirmed regularly, and scanning stops if it disappears. Related domains it discovers are shown to you for confirmation, never checked automatically.
How does pricing compare with per-asset EASM platforms?
Most enterprise attack surface platforms charge per asset, so the bill rises as discovery finds more of your estate. Attack Surface Scan charges a flat monthly price per plan, from $25/month, with a set number of domains and systems included. Exceeding a limit never creates an overage charge. See pricing and our worked comparison with Microsoft Defender EASM's published rate.
Does it find vulnerabilities?
Yes: known, published vulnerabilities in the software your internet-facing systems reveal, ranked by whether attackers are exploiting them now, plus software that is past its vendor's end of support. It does not attempt to exploit anything, so it complements rather than replaces a penetration test.
Can the reports be used for SOC 2, ISO 27001 or cyber insurance?
Yes, as evidence that you continuously monitor your external attack surface. Every scheduled check is kept, any report exports as a dated PDF, and the evidence pack shows monitoring operated across the whole period, with findings mapped to common frameworks. It is not a certification, a penetration test or a PCI ASV scan.
Does it work with the tools we already use?
Yes. Alerts go to email, Slack, Microsoft Teams, PagerDuty and Jira, or to any security tool that accepts a webhook. Findings, inventory and change history export to CSV, and Growth plans and above include a REST API. Setup guides are in the documentation.
Can I connect Attack Surface Scan to Claude or ChatGPT?
Yes. A hosted MCP server lets Claude, ChatGPT, Codex, Cursor and other AI assistants run checks, read findings, watch changes and generate reports, only for domains your account has verified. You sign in with your normal account; there are no keys to manage. Setup guide.
Can MSPs or agencies offer Attack Surface Scan to their clients?
Yes. The MSP plan ($149/month) monitors every client from one console, puts your own logo and name on the reports your clients receive, groups domains into client workspaces, and routes each client's alerts to their own channel. It covers 25 domains with unlimited checks and daily scheduling. See the MSP page.
How much does Attack Surface Scan cost?
Plans start at $25/month, with two months free on annual billing. Every plan starts with a 7-day free trial and no card is required to begin. See the pricing page for what each plan includes.
Where is the technical documentation?
In the help centre: how verification and checking work, every check with its severity and fix, integrations, the REST API and the public data sources used. It is written for the engineer or security reviewer you forward this page to.
Latest from the blog.
Comparisons, how-tos and plain-language explainers on what the outside world can see about your organization.
CISA Lists 2 Exploited Ivanti Connect Secure Flaws in KEV
CVE-2026-111357 and CVE-2026-118527 affect Ivanti Connect Secure. CISA added them to the Known Exploited Vulnerabilities catalog on October 30, 2026, with a federal due date of November 2, 2026. What is affected and what to check.
Read article →Fragnesia: the Linux Kernel Bug That Turned PHP2Shell Web Shells Into Root, Now on CISA KEV
CVE-2026-46300, the Fragnesia Linux kernel privilege escalation, was chained with PHP2Shell to root 25 firewall servers, and CISA added it to KEV on October 28, 2026 with an October 31 deadline. What it is, the attack chain, the fixed kernels and the mitigation.
Read article →A CVSS 2.7 VMware ESX Logging Flaw Was a China-Nexus Zero-Day, and Is Now on CISA KEV
CVE-2026-41709, a low-severity VMware ESX insufficient logging flaw patched in July 2026, was exploited as a zero-day by the China-nexus group Warp Panda, says CrowdStrike. CISA added it to KEV on October 28, 2026. The fixed builds and what to check.
Read article →What's New in Attack Surface Scan: October 2026 Detection Rundown
Everything Attack Surface Scan started detecting in October 2026: certificate chains through compromised or browser-distrusted CAs, Debian and Ubuntu backport-aware CVE matching, key-type-aware weak key checks, stricter domain scope, and the newly exploited CVEs your scans now flag.
Read article →How Attack Surface Scan Checks for New Vulnerabilities and CA Incidents, From PHP2Shell to eMudhra
What happens between a critical CVE or a CA compromise being announced and it showing up as a finding: what the scanner reads from your hosts, how it matches versions, why some products get potential matches and others do not, and how certificate chains are checked against browser distrust.
Read article →What's New in Attack Surface Scan: Exploited-Vulnerability Matching, Asset Inventory, Compliance Views and More
Everything added to Attack Surface Scan in September 2026: CVE matching ranked by CISA KEV and EPSS, 123-port exposure checks, an asset inventory, domain hygiene, website privacy checks, framework views, Teams, PagerDuty and Jira alerts, and a REST API.
Read article →Guides & explainers → · Security news → · TLS certificate news →
Simple, flat pricing.
Every check on every plan. Plans differ on how many domains are watched and how often, and none of them is metered per asset.
Starter
One domain, watched weekly, with reports you can hand to a client or an auditor.
- 1 verified domain, 20 hosts
- 25 scans per month
- Weekly scheduled scans
- Daily certificate checks, new-certificate watch every 15 min
- Change alerts & weekly digest
- PDF reports
- 2 team seats
- Every check: vulnerabilities, inventory, privacy, reputation
- Alerts to Slack, Teams, PagerDuty, Jira and webhooks
- Compliance framework views and CSV export
Growth
Daily coverage across a real estate, with unlimited scans while you fix things.
- 5 verified domains, 100 hosts each
- Unlimited scans
- Daily scheduled scans
- Certificate checks every 6 hours, new-certificate watch every 15 min
- Change alerts & weekly digest
- Lookalike domain monitoring
- 10 team seats
- PDF reports
- Every check: vulnerabilities, inventory, privacy, reputation
- REST API access
MSP
For MSPs, vCISOs and agencies: every client estate in one place, your brand on every report.
- 25 verified domains across your clients, 250 hosts each
- Client workspaces with per-client alert routing
- White-label PDF reports (your logo & name)
- Unlimited scans, daily scheduled scans
- Certificate checks every 6 hours, new-certificate watch every 15 min
- Lookalike domain monitoring
- 25 team seats
- Single sign-on (SAML or OIDC)
- REST API access
Enterprise
Unlimited domains, single sign-on, and a signed scanning agreement. For larger estates.
- Unlimited verified domains, 1,000 hosts each
- Unlimited scans
- Daily scheduled scans
- Unlimited team seats
- Single sign-on (SAML or OIDC), enforceable per domain
- REST API access
- Signed authorization-to-scan agreement
- Dedicated support
Yearly billing is 2 months free. Compare every plan and yearly pricing →
Run your first scan today.
Add your domain and have your first report in minutes. No card, no call, nothing to install.