Internal Attack Surface Management
identity, SaaS, endpoint protection and edge security
Grade the controls an attacker meets once inside, identity, endpoint protection, edge and code, in the same picture as your internet-facing estate.
Most breaches pass through an identity, an endpoint or a SaaS tenant, not only an exposed server. Identity providers, EDR consoles, web application firewalls and code platforms each have their own settings page, and nobody reviews them together: an administrator without MFA, an EDR policy left in detect-only mode or a WAF ruleset switched off stays invisible until someone uses it.
KnightGuard connects to your identity providers, EDR platforms, edge and code platforms through their APIs and checks their configuration against security best practice: hundreds of checks across Microsoft Entra ID, Okta, SentinelOne, Bitdefender, Cloudflare and GitHub, plus Microsoft's Zero Trust assessment. Each area is graded as its own pillar next to the external ones, and every failed check becomes a finding with fix steps, an SLA and a ticket.
Where it works in CTEM
Contribution by stage across the continuous exposure management lifecycle.
Share of this use case's platform capability at each CTEM stage. The five shares sum to 100%. & the cycle repeats continuously
SCOPING
15%Connect the sources. Choose the sources behind each pillar with Set up sources: Microsoft Entra ID and Okta for identity, SentinelOne and Bitdefender for endpoints, Cloudflare for the edge, GitHub for code.
DISCOVERY
30%Check every setting. Hundreds of configuration checks across those sources, plus Microsoft's Zero Trust assessment tests, re-run with every primary scan or weekly, depending on the source.
PRIORITIZATION
30%Grade each pillar. Each pillar gets a severity-weighted grade from A to F that rolls into one organisation grade with your external pillars; failed checks are broken down by source.
VALIDATION
10%Re-check after the fix. The next run re-checks every finding: a setting that was fixed closes on its own, and one that slips back reopens as Resurfaced.
MOBILIZATION
15%Fix steps and tickets. Fix steps on every finding, ATT&CK and NIST 800-53 mappings for identity checks, Jira or ServiceNow tickets through Send Details To The Team, and SLA due dates.
How it works
Each step follows the CTEM stage it belongs to.
Connect sources
Identity, endpoint, edge and code platforms
Check configuration
Best-practice checks and Zero Trust tests
Grade each pillar
Severity-weighted A to F, next to the external pillars
Fix and ticket
Fix steps, Jira or ServiceNow, SLA due dates
Re-check
Fixed settings close; regressions reopen
Key capabilities
Identity security
Microsoft Entra ID and Okta: MFA and phishing-resistant factors for administrators, sign-on and session policies, password policy, privileged role membership, API tokens and network zones.
Endpoint protection posture
SentinelOne and Bitdefender: whether agents are set to protect rather than only detect, anti-tamper, rollback, agent health and versions, exclusions, device and firewall control.
Edge and WAF
Cloudflare: WAF and OWASP managed rules, minimum TLS, HSTS, DNSSEC, bot protection, rate limiting and DNS proxying, so the edge in front of your applications is configured to protect them.
Code platform
GitHub organisation and repositories: two-factor enforcement, branch protection and reviews, signed commits, secret scanning and dependency alerts.
Microsoft Zero Trust
Microsoft's Zero Trust assessment tests across identity, devices, network, data and security operations, with a pass rate per area. Microsoft 365 workload checks are graded under cloud posture.
One grade, one lifecycle
Each pillar is graded from the share and severity of its failed checks and weighted into the organisation grade; findings follow the same lifecycle, SLA policy and ticketing as external findings.
Every control plane, graded
Identity, endpoint, edge, code and Microsoft sources, each graded and rolled into one organisation grade.
A failed setting, from finding to fixed
A failed setting becomes a finding with fix steps and a ticket, and reopens if it slips back.
Download the Internal Attack Surface Management Datasheet
Unlock the PDF linked to this use case after a short contact form. The file is saved to your downloads folder immediately after submit.
Ready to level up your cyber defence?
Supports modern enterprises with agentic AI discovery, real-time threat validation, and autonomous exposure prioritization.