An attack surface is not a photo. It is a film. New subdomains, changed services and newly published CVEs shift the picture every day. A single pentest once a year cannot keep up. SecTepe SnapScan answers this with a Continuous Threat Exposure Management (CTEM) approach. It also adds two new recon paths that cover spots that used to be blind.
The CTEM Loop: Scope, Discover, Validate, Prioritize, Mobilize
With the ScanSchedule model, you can repeat scans on a fixed schedule. That way, exposure is checked again and again. This follows the classic CTEM cycle:
- Scope – define what is part of the attack surface.
- Discover – keep finding assets and services.
- Validate – check which of them are really exposed and can be exploited.
- Prioritize – rank them by real risk.
- Mobilize – turn the results into action, as GRC evidence in SecTepe.Core.
A dedicated KPI view at /console/ctem shows progress over time. You see the trend, not just the latest scan.
Passive OSINT Footprint Engine: Recon Without Touching
Some recon must not touch the target at all. This is true in early proposal phases or for third-party assets. The new passive OSINT footprint engine works in a purely passive way. It gathers public information about the attack surface and never contacts the target. That is legally clean. It still gives you a solid first picture of your exposure.
Tor/Onion Scanning for Hidden Services
Part of the attack surface is not on the clearnet. Think of leak portals, hidden services and exposed onion endpoints. SnapScan can now scan .onion targets over a SOCKS proxy. It comes with its own Dockerfile.tor and Compose setup. This lets you check two things:
- Are your own services reachable over Tor by mistake?
- Does infrastructure linked to your company show up on the dark web?
Note: the internal cloud security posture check (CSPM) is built as a building block. It is turned on per cloud provider once a customer provides credentials. It is an outlook, not a finished multi-cloud scanner.
Why These Belong Together
CTEM without good recon checks an incomplete scope. Passive OSINT and onion scanning extend exactly that scope. Add the AI pentest agent for depth and rapid response for new CVEs. Together they form a loop that keeps exposure small at all times.
Conclusion
SnapScan now has scheduled repeat scans, a KPI view a passive OSINT footprint engine and active scanning of .onion targets via Tor. This turns it from a point-in-time tool into continuous exposure management. That is just what frameworks like NIS-2 expect when they call for "ongoing" risk monitoring.