Attack surface management: keep your exposure in view
Attackers start from the outside. They look for old test sites, forgotten subdomains and open ports. SnapScan looks in the same places, just sooner. You see what is new, what has changed and what to fix first.
Request a demoWhy your attack surface keeps growing
Your attack surface is everything of yours that can be reached on the internet. That means domains, websites, services and cloud storage. It often grows without a plan. An agency puts a campaign site online. A team tests a server and forgets about it.
External attack surface management, or EASM, makes all of this visible. It checks it again and again, not just once a year. Our glossary entry onattack surface managementcovers the basics. This page shows what SnapScan does about it.
How SnapScan finds your systems
Passive discovery and OSINT
OSINT means intelligence from open, public sources. SnapScan uses these sources to find subdomains and network ranges. The passive scan does not attack anything. It sees only what a browser would see anyway.
An inventory with approval
Every find goes into the asset inventory, your list of all systems. A new asset starts as "discovered". It is only scanned once you approve it. You exclude anything that is not yours. SnapScan links each asset to its network provider and shows everything on a network map.
Cloud services, seen from outside
Without any credentials, SnapScan spots open cloud storage and dangling DNS records. A dangling record still points to a service that no longer exists. Someone else could take it over and show content under your name.
Spot changes instead of hunting for them
A one-off list goes stale fast. So SnapScan runs scans on a fixed schedule, from hourly to every 90 days. The default is weekly. Before each run, SnapScan checks that the engagement is active and inside its time window.
- Change detection: a diff shows what is new since the last scan and what is gone.
- Exposure score: each target gets a rating, so you see at a glance where the fire is.
- No duplicates: a finding stays one record. SnapScan tracks when it was first and last seen.
Our article onCTEM in SnapScanexplains the loop of discovering, validating and prioritizing.
Fix what attackers actually use first
Not every flaw is equally urgent. SnapScan adds data from two sources to each finding. The CISA KEV catalog lists flaws that attackers already exploit. EPSS estimates how likely an attack is in the near future. Your team can work on what matters most first.
When a new critical flaw is published, rapid response helps. One call retests every target in an engagement for that exact flaw. SnapScan checks scope and time window for each target.
Only with authorization
SnapScan only tests targets you are authorized to test. If your email domain matches the target domain, the scan starts right away. Freemail addresses do not count. Otherwise you prove ownership with a DNS TXT record. On the platform, an engagement sets scope, time window and kill switch.
Legal notice: Scans only take place with the permission of the owner of the systems tested. Scanning other people's systems without permission may be a criminal offense.
FAQ on attack surface management
- What is external attack surface management (EASM)?
- EASM means you keep track of everything your company exposes on the internet. That includes domains, subdomains, web services and open ports. Then you check these systems for flaws on a regular basis. SnapScan does both on one platform.
- Will passive discovery disrupt our operations?
- No. Passive discovery only uses public sources. It sees only what a browser would see anyway. More active scans only run when an engagement allows them for a target.
- How often should we check our attack surface?
- You decide. SnapScan schedules scans at any interval from one hour to 90 days. If you do not choose, scans run weekly. A newly launched server shows up by the next run at the latest.
- Can I monitor any domain?
- No. You can only monitor domains you are authorized to test. You prove this with your email domain or a DNS TXT record. On the platform, an engagement sets targets and time windows. SnapScan rejects everything outside of it.
See your attack surface live
We will show you SnapScan on a sample target. Then you will know what EASM could look like for you.
Request a demoHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.