Security monitoring · CISSP-led
External Attack Surface Monitoring
Your attack surface is everything about your business that anyone can see or reach from the internet: websites, email settings, login pages, and old systems you may have forgotten. AI agents watch it every day, a person checks every finding, and you get a plain-language report each month.
Include your domain in the message. Nothing to install. We verify you control the domain before we send any results.
Most businesses have more online than they remember
Over the years, most businesses collect more online than they remember: an old version of the website, a test site a developer set up, a login page for a tool nobody uses anymore. Security certificates (what makes the padlock show in a browser) expire. Staff passwords turn up in data breaches at other companies. None of this is unusual. The problem is that nobody is assigned to watch it, so most businesses check once a year, or never. Automated tools across the internet look for exactly these things every day, so it makes sense to see them first.
What we watch, and what we don't touch
We only look at what's already public, the same way any visitor or search engine would. We don't log in, try to break in, or install anything. We watch the websites, subdomains, and online services tied to your domain; changes to your domain settings (DNS, the internet's address book for your domain); security certificates and when they expire; your staff email addresses in publicly known data breaches; and software you run online that has known, published security problems. AI agents do the daily watching. A CISSP-certified person checks every finding before it reaches you, so you only see what's real and worth your time.
What you get, step by step
-
We verify and make the list. You confirm you control the domain, then we find the websites, services, and certificates tied to it. You tell us which ones should be there.
-
We watch it every day. New sites, new login pages, leaked staff passwords, certificates about to expire, and newly published security problems in software you use. If something looks urgent, a person checks it and contacts you instead of waiting for the monthly report.
-
You get a monthly report. What changed, what's visible, and what to fix first, in plain language. If you want us to handle a fix, we'll tell you what it costs first.
A clear, current view, and someone watching it
You have a current picture of what your business shows to the internet, and someone watching it for you. Each finding comes checked, with a short explanation and a next step, not a long list of maybes. Monitoring looks from the outside and doesn't try to break in, so it won't catch everything. If you need someone to test whether they can actually get in, with your written permission, that's a penetration test.
Why it works for you
- Watched every day, not once a year
- A person checks every finding before you see it
- Covers websites, domain settings, certificates, and leaked staff passwords
- A short monthly report in plain language
- Public information only: nothing to install, no logins needed
- CISSP-led
Questions, answered
What is an attack surface?
Everything about your business that someone on the internet can see or reach: websites, login pages, email settings, online tools, and anything left over from past projects. "External" means we look from the outside, the way anyone else would.
How is this different from a vulnerability scan?
A scan is a one-time snapshot that produces a long raw list. Monitoring runs every day, looks only at what's visible from the internet, and a person checks each finding before you see it. You get a short list with context and next steps.
Is this safe for our systems?
Yes. We only look at information that's already public, the way any visitor or search engine would. We don't log in, try to break in, or install anything. Testing whether someone can actually get in is a separate service, a penetration test, and it always requires your written authorization first.
What's in the free exposure check?
A person-reviewed summary of what's publicly visible for your domain and what to look at first. The results describe weak spots, so they only go to the domain's owner: before we send anything, we verify you control the domain, for example with a reply from an email address on that domain. We reply within one business day to start that step. No obligation.
What do you need from us?
Your domain name, and proof that you control it. If you have systems on other domains, tell us and we'll include them after verifying those too. Nothing to install and no network access needed.
What happens if you find something urgent?
A person checks it first, then contacts you with what it is and what to do, instead of waiting for the monthly report. If you want us to fix it, we'll give you the cost first.
What does it cost?
Monitoring is a monthly plan, quoted to fit how many domains and services we watch. Nonprofits and first-time clients get 20% off automatically. The free exposure check is a good place to start, since it shows what there is to watch.
Monitoring or a pen test?
- You want an ongoing watch on what your business shows the internet. You're here: External Attack Surface Monitoring.
- An insurer, auditor, or client wants proof that someone tried to get in, and what they found. See Agentic Penetration Testing.
Many businesses do both: monitoring all year, and a pen test once a year or after big changes.
See what your business shows the internet
Send us your domain. We reply within one business day to verify you control it, then a person reviews what's visible and tells you what, if anything, to fix first.