Both products start from the same fact: every publicly trusted certificate is written to a public certificate transparency log before a browser will accept it. Read the logs and you learn about a certificate for your domain the moment it exists, whether you asked for it or not. From that shared starting point the two products go different ways. This comparison is written by the Attack Surface Scan team; every claim about Cert Spotter comes from its public site, help centre and changelog as of September 2026, and we have marked the rows where Cert Spotter is ahead as plainly as the ones where we are.

What each product is

Cert Spotter is SSLMate's monitoring product, sold alongside its certificate issuance service. It ingests every browser-recognised CT log continuously, indexes certificates by name, and alerts on any certificate for your domains that is not "known". Known means the CA is on your authorized list, the domain's CAA records permit it, you pre-registered the public key through its Authorization API, or you acknowledged that certificate by hand. It also checks the certificate actually installed on each endpoint (chain, hostname, revocation, OCSP stapling) hourly on the entry plan and every 5 minutes on the top one, from ten locations. SSLMate publishes the log reader at the heart of it as open source.

Attack Surface Scan is an external attack surface monitor. Certificates are one module of a scan that also covers HTTP security headers, DNS and email authentication, subdomain discovery, exposed services and lookalike domains, with every scan diffed against the last so the product reports what changed rather than restating what is wrong. Its certificate monitoring reads CT logs every 15 minutes, keeps an authorized-CA list that fills itself in from the certificates your verified hosts serve, queues unknown certificates for a one-click acknowledgement, and probes the served certificate on every monitored host daily or every six hours by plan.

Where the two match

  • Certificate transparency monitoring with a known-versus-unknown workflow, an authorized-CA list at account and domain level, and CAA-aware matching.
  • Automatic subdomain discovery from CT, with every discovered name becoming a monitored endpoint and an exclusion list for the ones you do not want.
  • Installed-certificate checks for chain validity and hostname coverage, with per-domain expiry thresholds and an alert when an endpoint cannot be reached.
  • Custom ports including SMTP with STARTTLS, so mail servers are covered.
  • MTA-STS monitoring for domains that receive mail.
  • Alerts by email, Slack and webhook, with team routing.

Where Cert Spotter is ahead

  • Detection latency. Cert Spotter ingests logs continuously and alerts within minutes. Attack Surface Scan reads the logs every 15 minutes, so its promise is "within the quarter hour". For most teams that difference is academic; for a team responding to an active phishing campaign it may not be.
  • Installed-certificate cadence. Hourly, every 15 minutes, or every 5 minutes by plan, against daily on Attack Surface Scan's Starter plan and every 6 hours above it.
  • Ten probing locations on the Business plan, which catches a single CDN edge serving a stale certificate. Attack Surface Scan probes from one region.
  • Revocation and OCSP stapling verification, and detection of endpoints serving both an RSA and an ECDSA certificate. Attack Surface Scan checks chain, hostname, key size and protocol, and stops there today.
  • An API-key REST API and an Authorization API that accepts a CSR before issuance, so an ACME pipeline can pre-authorize keys and never trigger an alert. Attack Surface Scan's programmatic surface is a hosted MCP server for AI agents; API keys and CSR pre-authorization are on its roadmap.
  • DNS provider integrations (Cloudflare, Route 53, Azure DNS and others) that publish approval records for you, and an account audit log with retention by plan.

Where Attack Surface Scan goes further

  • Everything around the certificate. HSTS, CSP and CORS headers, exposed database and admin ports, technology fingerprint drift, dangling-CNAME subdomain takeover, and lookalike domain registrations. Cert Spotter has no equivalent for any of these.
  • Stalled renewal, before it is an outage. A 90-day certificate still being served at 70% of its lifetime has almost certainly outlived its renewal job. Attack Surface Scan says so weeks before an expiry warning would; Cert Spotter warns on expiry only.
  • The domain itself. Registration expiry is checked via RDAP with warnings at 60, 30, 14 and 7 days. A lapsed registration is worse than any certificate problem.
  • SPF, DMARC and TLS-RPT alongside MTA-STS, so the whole email posture of a domain is in one place.
  • An authorized-CA list that writes itself. A certificate served with a valid chain on a host you have verified is one you deployed, so its CA is authorized. The list fills in from the first scan and you only ever trim it.
  • Reports and workspaces. Branded PDF reports, a compliance evidence pack for SOC 2 CC7.1 and ISO 27001 A.8.8, and for MSPs, client workspaces with per-client alert routing under their own brand.

How they price

Cert Spotter charges per endpoint: Hobbyist at $15/month for 20 endpoints with hourly checks, Startup at $100 for 150 endpoints every 15 minutes, and Business at $500 for 1,000 endpoints every 5 minutes from ten locations, all with a 30-day trial.

Attack Surface Scan charges per registrable domain with hosts included: Starter at $25/month for one domain and 20 hosts with daily certificate checks, Growth at $49 for five domains and 100 hosts each with checks every six hours, and MSP at $149 for 25 domains and 250 hosts each. Every plan reads CT every 15 minutes and includes the full external scan. The trial is 7 days with no card.

A one-domain estate with a dozen hosts pays $25 here against $15 there and gets the whole external scan for the difference. A five-domain estate with a hundred hosts pays $49 here against $100 there. A thousand-endpoint estate that needs 5-minute checks is squarely Cert Spotter's territory.

Can you use both?

Yes, and some teams do: Cert Spotter for its minute-level installation checks and multi-location probing, Attack Surface Scan for the rest of the surface and the weekly digest. Both deliver to Slack and webhooks, so the two can land in the same channel. One caveat worth knowing: Attack Surface Scan's CT ingestion runs SSLMate's open-source certspotter daemon on our own infrastructure under its Mozilla Public License, so the two products see the same logs through the same parser; the difference is in cadence and in what happens after a certificate is found.

Which one fits

Choose Cert Spotter if certificates are the whole job: a large estate, an ACME pipeline that should pre-authorize keys, a need for 5-minute checks from several continents, or revocation and stapling verification.

Choose Attack Surface Scan if you want certificate monitoring done properly inside a wider watch, with a stalled-renewal detector, the domain registration itself covered, and the headers, ports, subdomains and lookalikes that a certificate monitor never looks at. The feature matrix has every row with a yes, a partial or a no on each side.

Frequently asked questions

Does Attack Surface Scan read certificate transparency logs itself?

Yes. It runs SSLMate's open-source certspotter daemon as its ingestion engine on its own infrastructure, every 15 minutes, against a watchlist of every verified domain. The daemon follows every log in the Chrome and Apple log lists.

Which one alerts faster on an unexpected certificate?

Cert Spotter, by up to fifteen minutes: it ingests continuously, Attack Surface Scan reads the logs on a quarter-hour schedule. Both alert immediately once the certificate is seen and classified as unknown.

Do I have to configure authorized CAs by hand?

In Cert Spotter you list the CAs you use, or rely on CAA and the Authorization API. In Attack Surface Scan the list seeds itself from the certificates your verified hosts actually serve with a valid chain, and CAA is honoured too; you add a CA by hand only before its first certificate appears, and you can trim the list at any time.

Is this comparison kept up to date?

Facts about Cert Spotter were checked in September 2026 against sslmate.com. If something has changed, tell us through the support page and the article and the comparison page will be corrected.

Sources