Attack Surface Scan

Attack Surface Scan is an external attack surface monitoring (EASM) platform that continuously checks internet-facing infrastructure for security issues and configuration changes. The service operates without requiring agent installation or code changes, scanning only what is publicly visible from the internet. The platform monitors the following categories of external exposure: - HTTP security headers (HSTS, CSP, X-Content-Type-Options, Referrer-Policy, CORS, cookie flags) - TLS/certificate health (chain validity, expiry, protocol versions, key strength, hostname coverage) - DNS and subdomains (SPF, DMARC, CAA policies, subdomain discovery via certificate transparency logs, dangling CNAMEs) - Exposed services (open TCP ports, stack fingerprinting) - Lookalike/typosquat domain registrations - Domain registration expiry Findings are assigned severity levels (critical to informational) and aggregated into a 0-100 posture score. The platform re-scans on a schedule and alerts users to changes via Slack, email, or webhook. Critical changes trigger immediate alerts; other findings are batched into a weekly digest. Each scan can be exported as a branded PDF report suitable for clients, auditors, or internal stakeholders. The platform supports compliance evidence use cases, specifically referencing SOC 2 CC7.1, SOC 2 CC4.1, and ISO 27001 Annex A 8.8 controls. Attack Surface Scan includes AI integration features: a one-click prompt generator that formats findings for coding agents (Claude Code, Codex, etc.), and a hosted MCP server that allows AI assistants to run scans, retrieve findings, and generate reports via chat. An MSP plan ($149/month) supports 25 domains across multiple client workspaces with white-label branding and per-client alert routing. Standard plans start at $25/month with a 7-day free trial.