External Attack Surface Management
including Attack Path Identification
See your organisation the way an attacker does, and know which way in they would try first.
Internet-facing estates change every week: a new marketing site, a staging server left online, a cloud host nobody registered. Inventories fall behind, and a list of thousands of CVEs does not say which host actually gives an attacker a way in.
KnightGuard discovers everything reachable under your domain from the outside, with no agents and no credentials. It fingerprints what answers, matches products and versions to known-exploited and published vulnerabilities with a stated confidence, and scores every host for its attack probability: the likelihood, from 0 to 100%, that it gives an attacker initial access. Suppliers and subsidiaries get the same treatment.
Discovery and testing are non-intrusive: the scan observes and fingerprints what your hosts expose; it does not try to exploit anything.
Where it works in CTEM
Contribution by stage across the continuous exposure management lifecycle.
Share of this use case's platform capability at each CTEM stage. The five shares sum to 100%. & the cycle repeats continuously
SCOPING
10%Define the estate. Your primary domain, plus suppliers and subsidiaries as third parties. Authorization is recorded the first time a domain is scanned; port coverage and schedule are set per scan.
DISCOVERY
40%Find everything exposed. Subdomains, DNS and email posture, IP ownership, open ports and the services behind them, web technologies, certificates and takeover risks, on a schedule, with drift between runs.
PRIORITIZATION
25%Rank hosts by likelihood. Every host scored for attack probability across nine attack vectors. Vulnerabilities are graded confirmed, probable or advisory and checked against CISA KEV.
VALIDATION
15%Prove the path is open. Each step on a path carries the checks to confirm it yourself: a command for exposed services, web- and host-based steps for serious CVEs, a leaked-credential check for logins.
MOBILIZATION
10%Route fixes to owners. Due dates from your SLA policy, Jira and ServiceNow tickets, status synced back every 15 minutes, and Resurfaced when a closed ticket did not fix the problem.
How it works
Each step follows the CTEM stage it belongs to.
Seed domain
Primary domain and third parties, authorization recorded
Discover
Subdomains, IPs, open ports, services, certificates
Fingerprint & match
Technologies and versions against KEV and NVD
Score each host
Attack probability, 0–100%, from nine attack vectors
Attack path
Internet to host to finding, with checks to confirm it
Ticket & track
SLA due date, Jira or ServiceNow, status sync
Key capabilities
Continuous discovery
Subdomains from passive sources, certificate transparency and permutations; every open TCP port (the top 1,000 or all 65,535) and the service answering on each, across more than 120 protocols.
Confidence you can act on
Each vulnerability is marked confirmed, probable or advisory, and by who can fix it: your team, a vendor, or monitor-only. Advisory matches that the detected version has patched are cleared automatically.
Graded security pillars
Application, DNS, email, infrastructure, web encryption, software patching, endpoint inventory, dark web posture and secret leaks, each graded A to F and weighted into one organisation grade.
Attack probability per host
Nine attack vectors combine into one likelihood. Decisive evidence such as a confirmed known-exploited CVE or a subdomain takeover sets a floor; a CDN or web application firewall lowers it, never to zero.
Drivers: the shortest route down
Every host lists the findings whose fix would lower its probability the most, so the first fix is the one that removes the most risk.
Drift and third parties
Infrastructure Drift shows what changed between scans. Suppliers and subsidiaries are scanned, graded and can be sent their own report on a schedule.
Outside-in discovery
From one seed domain to every exposed host, service and technology, compared scan to scan.
Seed domain
Start from one seed domain: no agents, no credentials, no access to internal networks.
Passive discovery
Subdomains are found from passive sources, certificate logs and permutations.
Resolution & ports
Each one resolves to addresses, open ports and the service answering on each.
Matching & CVEs
Technologies, versions and certificates are matched to known-exploited and published CVEs.
Drift comparison
Every scan is compared with the last: new hosts and ports surface as drift.
Attack probability and the path in
How a host's exposed services and findings add up to its attack probability, and the fix that lowers it most.
Score likelihood
Every internet-facing host is scored: the likelihood, 0–100%, that it gives an attacker a way in.
Map services
Its exposed services are mapped: what answers on each port, and which exact software version.
Weigh attack vectors
Findings on each service are weighed across nine attack vectors; red marks a route to critical compromise.
Drivers & validation
Drivers name the fix that lowers probability most, with non-intrusive checks to validate it first.
What changes for the team
- An inventory of your internet-facing estate that updates itself, including the hosts nobody registered.
- A short, ordered list of hosts to fix first, instead of a CVE backlog sorted by CVSS.
- Evidence your teams can check for themselves before they invest in a fix.
- The same view of every supplier and subsidiary you depend on.
Works with
Download the External Attack Surface Management Datasheet
Unlock the PDF linked to this use case after a short contact form. The file is saved to your downloads folder immediately after submit.
Ready to level up your cyber defence?
Supports modern enterprises with agentic AI discovery, real-time threat validation, and autonomous exposure prioritization.