Attack Surface Management
See what an attacker sees, continuously
Your external attack surface changes every time someone registers a subdomain, ships a staging environment, or leaves a debug flag enabled. Sentinel discovers what you own across DNS, cloud, and code, fingerprints every exposed service, and tells you which handful of assets actually deserve attention this week.
- Discovery and analysis modules per target
- 12
- Continuous rescanning on your schedule
- 24/7
- Exploit probability on every scored CVE
- EPSS
- Board-ready reports generated on demand
Scope
What the engagement covers
- Continuous subdomain, DNS, and IP discovery
- Live web asset fingerprinting and technology detection
- Port, service, and CPE identification across every resolved host
- WAF and CDN coverage detection per host
- Endpoint and hidden parameter discovery
- Risk-scored findings with CVE, CVSS, and EPSS context
Platform
What the platform looks at
Every target runs through the full pipeline. Each module feeds a single asset picture, so a finding on a subdomain arrives with its DNS records, open ports, technology stack, and WAF status already attached.
Subdomains
Passive and active enumeration across certificate transparency logs, DNS aggregators, and resolution sweeps, deduplicated into one owned-asset list.
DNS records
Full A, AAAA, CNAME, MX, TXT, and NS inventory per hostname, with dangling-record detection that catches subdomain takeover risk early.
Web assets
Every resolved host is probed for a live HTTP response, then catalogued by status code, page title, detected technology, and IP.
Tech fingerprint
Framework, server, and language detection per host, including version numbers and the security headers each host does or does not set.
WAF detection
Per-host WAF and CDN identification, so you can see at a glance which assets sit exposed behind no edge protection at all.
Ports
Open port and service discovery with product, version, and CPE mapping, flagging high-risk and unexpected exposure.
Screenshots
Visual reconnaissance of every live host, with login pages and admin panels called out separately for review.
Endpoints
URL and path discovery from crawling, archived sources, and JavaScript parsing, scored so authentication and export endpoints rise to the top.
Hidden parameters
Parameter discovery against live endpoints, surfacing undocumented inputs that never appear in any specification.
Findings
Vulnerabilities from every module in one severity-ranked table, carrying CVE, CVSS, EPSS, status, and discovery time.
Asset map
Geographic and provider view of where your infrastructure actually runs, separating cloud-hosted assets from standard IPs.
WHOIS / RDAP
Registration, registrar, expiry, and nameserver detail per domain, with IP ownership and ASN resolution alongside it.
Outcomes
Why teams choose this
Discovery you did not ask for
Forgotten staging hosts, dangling DNS records, and shadow IT surface without anyone filing a ticket.
Prioritised, not enumerated
Findings carry CVSS and EPSS alongside asset context, so the critical few separate from the noisy many.
Evidence attached
Every finding links to the request, screenshot, or service banner that proves it.
Trend over time
Risk is scored per asset, target, and project, so you can show exposure falling quarter on quarter.
Process
How we work
- 1Organisation and domain ownership verification
- 2Passive discovery across DNS, certificate transparency, and cloud metadata
- 3Active resolution, port scanning, and service fingerprinting
- 4Endpoint, parameter, and content discovery
- 5Vulnerability detection and risk scoring
- 6Scheduled rescanning with change alerting
Deliverables
What you receive
- Continuously updated inventory of every internet-facing asset you own
- Severity-ranked findings with CVE, CVSS, EPSS, and evidence attached
- Portfolio risk score with per-project and per-asset trend history
- On-demand PDF reports scoped to a single target or an entire project
- Scheduled rescans with alerting on newly exposed assets
Questions
Frequently asked
How do you know which assets belong to us?
You verify ownership of a domain when you add an organisation. Discovery then expands outward from verified seeds through DNS, certificate transparency, and ASN relationships. Anything ambiguous is presented for confirmation rather than silently assumed.
Is scanning intrusive?
Discovery and fingerprinting are non-intrusive and safe to run against production. Vulnerability checks are non-destructive by default, and anything more aggressive requires explicit opt-in per target.
How often does it rescan?
You set the schedule per target — daily, weekly, or monthly — and can trigger an immediate scan at any time. Newly discovered assets are picked up automatically on the next run.
Can we export the data?
Yes. Endpoints, ports, DNS records, and web assets all export directly, and full PDF reports can be generated per target or project whenever you need one.
Related
Other services
Web Application Penetration Testing
Manual, exploit-verified testing across the OWASP Top 10 and your own business logic.
SAST – Static Application Security Testing
Source-level analysis wired into your pipeline, so flaws never reach a release branch.
DAST – Dynamic Application Security Testing
Authenticated scanning against the running system, including multi-step flows and APIs.