Know everything you expose

Everything you own, external, internal, cloud and code, in one living context. Each exposure classified, evidenced and routed to its owner.

Get StartedBook a demo

One living inventory of everything you own. External, internal, cloud and code, discovered on every run.

Assets12,480
Search assets…
Exposed · 37No hostname · 57New this week · 214
  • grafana.ops.internalInternal by name, open to 0.0.0.0/0
  • s3://acme-support-uploadsBucket policy allows public read
  • 10.20.4.17No hostname · discovered this week
  • checkout.acme.comInternet-facing · 4 services
Inventory
Assets
12,480
Domains & IPs
2,640
Internal hosts
4,380
Cloud resources
5,300
Buckets
118

What changed this week. New hosts, opened ports, shadow and zombie APIs, diffed against the last run.

AssetsChanges
Aug 27 → Sep 3
Newly exposed9
legacy-api.acme.comRetired in the docs, still answers 200Tue 02:14
34.201.8.19:5432Security group opened 5432 to 0.0.0.0/0Wed 11:40
s3://acme-support-uploadsBucket policy allows anonymous readWed 16:02
grafana.ops.internalInternal by name, now reachable on :443Thu 08:51
New214
preview-482.acme.devPreview env for acme/web #482Mon 19:20
api.acme.com/v3/exportNew route, absent from the OpenAPI specTue 10:05
acme/billing-workerNew repository in the connected GitHub orgWed 09:12
Changed37
checkout.acme.comTLS renewed, 2 routes addedThu 03:30
vpn.acme.comOpenVPN 2.5.8 → 2.6.12Thu 06:10
Retired31
old-cdn.acme.comDNS record removed, no longer resolvesMon 08:00
i-0b3f9a12 (staging)Instance terminatedTue 22:45

Exposure with context, not a port list. Every asset is classified by auth state, sensitive data and critical paths.

Auth state

Every route is probed for what it takes to get in: nothing, a session, or SSO. Public and privileged surfaces are ranked apart, and undocumented routes are probed the same way.

Sensitive data

Responses are sampled for personal data, credentials and internal identifiers, so an open endpoint serving customer records outranks one serving a logo.

Critical paths

Each exposure is placed on the paths it sits on, from the edge through code to the data it reaches, so a hop into customer records outranks a stray dev box.

Evidence that drives action. Every exposure carries proof of reachability and routes to the owner who can close it.

IssuesISSUE-2052
Subscribed···

Retired API still serves customer records without auth

SeverityHigh
StatusValidated
Targetlegacy-api.acme.com/v1/customers
http_exchange
1GET /v1/customers?page=1 HTTP/2
2host: legacy-api.acme.com
3// no cookie, token or SSO header
4
5HTTP/2 200 OK
6{ "customers": [{ "email": "j.doe@…", "phone": "+1 415…" },
7 … 48,112 more ] }
ActivityEvidenceOwnership
Routed to
ML
Marco Lee
@acme/platform
Accepted
Why
  • CODEOWNERS in acme/api/services/legacy-api → @acme/platform
  • acme-prod i-0b3f9a12tag team=platform
  • ISSUE-1998 on the same hostfixed by Marco Lee, 3 weeks ago
Trusted by security teams