SurfaceDiff

SurfaceDiff is an attack surface monitoring platform that continuously scans internet-facing assets to detect changes in an organization's external exposure. The platform performs scheduled reconnaissance across domains, subdomains, DNS records, open ports, TLS certificates, live web services, and crawlable endpoints — mirroring the techniques an attacker would use.

Its core workflow follows four stages:

• Scan: Collects data on publicly exposed assets on a recurring schedule
• Normalize: Converts raw scan results into a structured snapshot for consistent comparison
• Diff: Compares the current snapshot against the previous one to identify new, changed, or removed assets
• Alert: Delivers findings with severity ratings, titles, and timestamped evidence

Open ports are fingerprinted to identify the actual running service and version, not just whether a port is open. When a known exposure is reviewed and acknowledged, it is suppressed from future alerts until the state changes again, reducing noise for recurring findings.

SurfaceDiff includes an audit trail that logs every mute, review, and re-enable action with the responsible user and a reason, supporting accountability and compliance workflows. The platform supports team-based access with Owner, Admin, Member, and Viewer roles, allowing scoped access per client or domain.

The product targets multiple customer segments, including managed service providers (MSPs), managed security service providers (MSSPs), data centres, and managed cloud providers. A "Hosting Pilot" feature is available for organizations managing multiple customer domains. Pricing accounts for shared infrastructure by counting a shared host once rather than per domain hosted on it.

A free domain scan is available without account creation.