Compared: Cert Spotter
Cert Spotter vs. Attack Surface Scan
Both watch the public record of certificates issued for your domains and check the certificates your sites actually use. Cert Spotter stops there, and goes deep. Attack Surface Scan treats certificates as one part of the whole external attack surface, alongside your asset inventory, known vulnerabilities, exposed services, email security and lookalike domains. This page is the honest version of that comparison, including where Cert Spotter is ahead.
No card required to start. Plans from $25/month. Cert Spotter facts checked September 2026.
The short version
Choose Cert Spotter if
Certificates are the whole job. You want your certificates checked every few minutes from several continents, revocation checks, and an API that lets your automated certificate pipeline approve certificates before they are issued.
Choose Attack Surface Scan if
You want certificate monitoring inside a wider watch: a full inventory, known vulnerabilities ranked by exploitation, exposed services, lookalike domains, and the weekly digest plus evidence pack that a small team or an MSP hands to a client or an auditor, at a flat price.
What is the same
Watching for certificates issued in your name, a list of authorized providers, a queue for unexpected certificates, automatic discovery of new systems, mail server coverage, per-domain expiry warnings, email transport protection checks, and alerts by email, Slack or webhook.
Feature by feature
Cert Spotter's column is from its public site, pricing page, help centre and changelog. Ours is from the product as it ships today, not the roadmap; roadmap items say so. For the full technical detail behind our column, see the certificate documentation and the checks reference.
| Capability | Cert Spotter | Attack Surface Scan |
|---|---|---|
| Spotting certificates issued in your name | ||
| Detection of a new certificate for your domain | Yes continuous; alerts within minutes | Yes within about 15 minutes, on every plan |
| Flags certificates from a provider you did not authorize | Yes with manual acknowledgement | Yes with a review queue: acknowledge once, or acknowledge and trust that provider |
| List of authorized certificate providers | Yes configured per account and per domain | Yes fills itself in from the certificates your sites already use; editable per organization and per domain |
| Approve a certificate before it is issued | Yes through its API, for automated issuance pipelines | No on the roadmap |
| Finds new systems from those certificates | Yes every name seen becomes a monitored endpoint | Yes names that resolve join monitoring automatically, with an exclusion list, plus a warning when a forgotten name could be taken over |
| Handling of malformed or deceptive certificates | Yes hardened parser | Yes we run SSLMate's own open-source engine for this, under its licence, so the same parser |
| The certificates you have in use | ||
| How often they are re-checked | Yes hourly, every 15 minutes or every 5 minutes by plan | Partial daily on Starter, four times a day on Growth and above |
| Validity, name coverage and strength | Yes | Yes plus outdated encryption settings |
| Revocation checks | Yes | No not checked yet |
| Sites serving two certificates at once | Yes shows both | No one certificate per endpoint |
| Mail servers and other non-web services | Yes any service; Startup plan and above | Yes up to 10 extra per domain, mail servers included; every plan |
| Checking from several countries | Yes 10 locations on the Business plan | No one region |
| Early warning when automatic renewal has stalled | No | Yes raised weeks before the expiry warning would be |
| Alert when a site stops responding | Yes monitoring-gap notification | Yes after 18 hours of failed checks |
| Expiry warning timing | Yes account default, per-domain override | Yes per domain, then fixed reminders as expiry approaches |
| Domain registration expiry (the domain itself) | No | Yes warnings from 60 days out |
| Email security | ||
| Protection against mail being intercepted in transit | Yes email domains view | Yes |
| Protection against spoofed email from your domains | No | Yes |
| Alerts when your certificate-provider restrictions change | Yes | Yes |
| Beyond certificates | ||
| Inventory of internet-facing systems, with where each is hosted | Partial monitored endpoint list | Yes with third-party dependencies, related domains and change history |
| Known vulnerabilities, ranked by active exploitation | No | Yes |
| Exposed databases, remote access and admin tools | No | Yes more than 120 service types; alerts when one appears |
| Website security settings | No | Yes |
| Website privacy (unencrypted forms, tracking before consent) | No | Yes |
| Domain registration hygiene (transfer locks, registrar sprawl) | No | Yes |
| Blocklist and reputation monitoring | No | Yes |
| Forgotten names that someone else could take over | No | Yes |
| Lookalike and typosquat domains | No | Yes Growth and above |
| Reports, audit evidence and compliance framework views | No | Yes SOC 2, ISO 27001, OWASP Top 10, PCI DSS, CIS Controls, GDPR |
| Client workspaces and white-label reports | No | Yes MSP plan |
| Integrations, API and account | ||
| Email, Slack and webhook alerts | Yes webhooks on Startup and above | Yes every plan, plus Microsoft Teams, PagerDuty and Jira |
| Weekly digest | Partial daily expiring-certificate summary | Yes what changed this week, grouped by domain, suppressed findings left out |
| REST API | Yes can manage monitored domains and pre-approve certificates | Partial read-only, Growth and above |
| AI assistant access | No | Yes Claude, ChatGPT, Cursor and others can run checks and read findings |
| DNS provider integrations | Yes Cloudflare, Route 53, Azure DNS and others | No ownership is proven with one of four simple methods instead |
| Team seats | Yes multiple address routing on Startup and above | Yes roles and invites on every plan; 2 to 25 seats by plan |
| Audit log | Yes 30, 90 or unlimited days by plan | No change feed only; account audit log is on the roadmap |
Where Cert Spotter is ahead
Said plainly, because a comparison that only lists wins is an advert.
More frequent certificate checks
Every 15 minutes on Startup and every 5 minutes on Business, against our daily and four-times-a-day checks. If a misdeployed certificate needs to be caught inside a quarter hour, that gap matters.
Ten checking locations
Business-plan sites are checked from every continent but Antarctica, which catches a regional content network serving an out-of-date certificate. We check from one region.
Deeper certificate checks
Cert Spotter detects revoked certificates and handles sites that serve two certificates at once. We check validity, name coverage, strength and encryption settings, and stop there for now.
A writable API and pre-approval
An API that manages monitored domains, and lets an automated pipeline approve a certificate before it is issued so it never alerts. Our API (Growth and above) is read-only; changes go through the app or an AI assistant, and pre-approval is on the roadmap.
Where Attack Surface Scan goes further
The rest of the attack surface
A full inventory of your internet-facing systems, known vulnerabilities ranked by active exploitation, exposed databases and admin tools, website security and privacy, forgotten names someone could take over, and lookalike domains, all compared check to check and alerted on. Cert Spotter has no equivalent for any of it.
Stalled renewal, before it is an outage
A short-lived certificate still in use well past its usual renewal point means automatic renewal has quietly stopped. We say so weeks before the expiry warning would, which is the failure that actually takes sites down.
Reports someone can hand over
Branded reports and a compliance evidence pack showing that monitoring ran all period, for SOC 2, ISO 27001 and cyber-insurance questionnaires. MSPs get client workspaces and per-client alert routing under their own brand.
An authorized-provider list that writes itself
A valid certificate already in use on a site you have verified is one you deployed, so its provider is authorized. The list fills in from your first check and you only ever trim it. Domain registration expiry is watched too.
Every Attack Surface Scan check is read-only and runs only against domains whose owner has proven control, by one of four simple methods (see getting started). Nothing is installed; nothing is checked without proof of control.
Pricing side by side
Cert Spotter prices per endpoint. Attack Surface Scan prices per domain, flat, with systems included. Both offer annual billing; Cert Spotter's trial is 30 days, ours is 7 days with no card.
| Cert Spotter | Monthly | Covers | Certificate checks |
|---|---|---|---|
| Hobbyist | $15 | 20 endpoints | hourly |
| Startup | $100 | 150 endpoints | every 15 minutes |
| Business | $500 | 1,000 endpoints | every 5 minutes, 10 locations |
| Attack Surface Scan | Monthly | Covers | Certificate checks |
|---|---|---|---|
| Starter | $25 | 1 domain, 20 systems each, full external check weekly | daily, new-certificate watch every 15 minutes |
| Growth | $49 | 5 domains, 100 systems each, full external check daily | 4 times a day, new-certificate watch every 15 minutes |
| MSP | $149 | 25 domains, 250 systems each, full external check daily | 4 times a day, new-certificate watch every 15 minutes |
Cert Spotter prices from sslmate.com/certspotter/pricing, checked September 2026. Ours are generated from the same plan catalog checkout uses, so they cannot drift.
Questions people ask
Is this page fair to Cert Spotter?
That is the intent. Cert Spotter is a good product and a narrower one: it watches the public certificate logs and the certificates you have installed, deeply, and nothing else. Every row above where it is ahead is marked as such. Facts about Cert Spotter come from sslmate.com and were last checked in September 2026. If something is wrong or out of date, tell us and it will be corrected.
Do you watch the public certificate records yourselves?
Yes, using SSLMate's own open-source engine, run on our infrastructure under its licence, so both products read the same public records the same way. We run it every 15 minutes rather than continuously, which is why our detection time is "within the quarter hour" and theirs is "within minutes". The technical detail is in our certificate documentation.
Can I use both?
Certainly. Some teams keep Cert Spotter for its 5-minute installation checks and multi-location checks and use Attack Surface Scan for everything around the certificate: the asset inventory, known vulnerabilities, exposed services, lookalike domains, and the evidence pack an auditor asks for. Both send to Slack and webhooks, so they can land in the same channel.
How does pricing compare?
Cert Spotter charges per endpoint. Attack Surface Scan charges per registrable domain, with a number of hosts included per domain (20 on Starter, 100 on Growth, 250 on MSP). A small estate with one domain and a dozen hosts pays $25 here against $15 there, and gets the full external scan for the difference. A larger estate with five domains and a hundred hosts pays $49 here against $100 there.
What does Cert Spotter do that you do not?
Certificate checks every 5 to 15 minutes on its upper tiers, checking from ten locations, revocation checks, handling of sites that serve two certificates at once, an API that can manage domains and approve certificates before issuance, DNS provider integrations, and an account audit log. Several of these are on our roadmap; the multi-location probing is not.
See the whole surface, certificates included.
Verify a domain and get the full external picture, with new certificates watched from the first quarter hour.
Start your 7-day trialNo card required to start. Cancel any time.