See what's exposed on your attack surface
Find the domains, subdomains, IPs and open ports you have on the internet, including Shadow IT, and keep testing them with payload-based tests from ethical hackers.
Where Surface Monitoring fits
Every product runs on the same Discovery layer. Surface Monitoring turns Discovery into continuous testing, and it recommends which assets need a deeper look from Application Scanning or API Scanning.
Discovery
The system of record for your attack surface. Every asset flows through Discovery, so assessments read from it and findings feed back into it.
How Surface Monitoring works
Find the assets you forgot you had
Add a root domain, an IP or a CIDR range, or connect your DNS provider. Surface Monitoring maps subdomains from certificate transparency logs, DNS enumeration and brute-forcing, so forgotten subdomains, Shadow IT and acquired infrastructure show up. For every subdomain it resolves IPs, finds open ports and fingerprints the technology running on it.
- DNS connectors for AWS, Azure, GCP, Cloudflare, GoDaddy, DigitalOcean, Alibaba and IBM NS1
- New subdomains, open ports and technology changes picked up on every discovery cycle
- Automatic classification and scan recommendations
Payload-based tests written by ethical hackers
Surface Monitoring runs payload-based tests against the assets it discovers. The tests come from 1,765+ modules built by ethical hackers in the Crowdsource community, and each module goes through QA review before it runs against customer assets. They cover CVEs in fingerprinted technology, misconfigurations that lead to XSS, SSRF or RCE, exposed keys and credentials, Kubernetes and container misconfigurations, and DNS and domain expiration.
- SSL/TLS and certificate checks run alongside the payload tests
- Findings prioritized by severity and sent to Jira, Slack, Microsoft Teams and PagerDuty, with 100s more via Workato
- 99% of found vulnerabilities have no CVE assigned, based on our own data over the past three years
Find dangling DNS records before someone claims them
Surface Monitoring keeps checking your subdomains for takeover. If a CNAME points at a deprovisioned AWS or Azure resource or an unclaimed GCP bucket, Surface Monitoring flags it so you can remove the record before someone else claims the resource.
- Checks every 8 hours, including GCP bucket takeover
- Takeover findings sent straight to Slack, Jira or Microsoft Teams
- Findings close automatically once the record is fixed
Set your own rules for the attack surface
Write IF-THEN rules on anything you can filter in the attack surface view, and Surface Monitoring applies them to the assets it discovers, so your standards don't stay in a Notion doc.
- Open ports and DNS record types
- Technology and hosting provider changes
- Domain names
Bring your IP ranges too
Add IPv4 addresses or CIDR ranges such as 192.168.1.0/24. Surface Monitoring expands the ranges to individual IPs, checks open ports and protocols, and runs HTTP tests on them.
- Add single IPs or CIDR ranges directly, alongside your domains
- Around 8,500 ports checked per IP, with ports 80 and 443 re-checked every 24 hours
- Location data for every IP, so you can see where each one sits
Where security teams put Surface Monitoring to work
Shadow IT
Find the assets nobody told security about
Teams spin up new services, subdomains and cloud environments faster than security can catalog them. New subdomains and IPs show up as discovery runs, with their open ports and, for subdomains, the technology running on them.
M&A inheritance
Map the infrastructure you inherit in an acquisition
An acquisition brings a whole new attack surface with it. Add the acquired company's root domains and IP ranges and see what they expose.
Compliance
Evidence for your compliance program
Auditors want proof that your external attack surface is monitored and that vulnerabilities get tracked to closure. Surface Monitoring monitors it continuously and re-checks findings on every scan cycle, closing them once they're no longer found.
Surface Monitoring identifies what technologies each of our acquisitions has, its versions, and if they're outdated or if we need to consolidate or switch technologies across our different organizations so that we're aligned as an enterprise.
FAQs
CVEs in the technology it fingerprints, misconfigurations that lead to XSS, SSRF or RCE, exposed keys, tokens and credentials, Kubernetes and container misconfigurations, DNS issues, domain expiration and subdomain takeovers. 99% of found vulnerabilities have no CVE assigned, based on our own data over the past three years.
The tests are payload modules written by ethical hackers in the Crowdsource community, and each one goes through a QA pipeline before it runs against customer assets.
It doesn't log in, fuzz inputs or run out-of-band tests. API and business logic issues such as BOLA belong to Application Scanning and API Scanning. It can only test assets it can find through DNS records or the IPs you add, and IP support covers IPv4.
Surface Monitoring runs stateless, unauthenticated tests against the interfaces you already expose to the internet. Traffic comes from scanner.detectify.com with a Detectify user agent, so you can spot it in your logs or allowlist it.
No. A pentest covers what Surface Monitoring doesn't, such as logged-in testing and business logic. Surface Monitoring keeps testing your external attack surface continuously in between.
SaaS, with nothing to install. Add a root domain or connect your DNS provider and discovery starts. For apps on internal networks, see Internal Scanning.
Surface Monitoring covers breadth across everything you expose to the internet. Application Scanning goes deep into a single web app, with crawling, fuzzing and testing behind login. Surface Monitoring recommends which assets need a deeper scan, and you choose which ones to add.
Pricing is tiered by the number of domains in scope, and monitoring, discovery and classification are included. You can try it for 2 weeks on up to 2 apex domains. See pricing.
Application Scanning
Payload-based testing for custom web apps. The crawler renders JavaScript, handles single-page apps and tests behind login.
Learn more about Application Scanning
API Scanning
Payload-based testing for REST and GraphQL APIs, driven by your OpenAPI spec or GraphQL schema, including prompt injection on AI endpoints.
Learn more about API Scanning
Internal Scanning
The same payload-based testing for internal apps, through an agent that only connects outbound.
Learn more about Internal ScanningConnect DNS and start seeing findings
Continuous discovery and payload-based testing across your domains, subdomains, IPs and open ports.