External Attack Surface Management
including Attack Path Identification
See your organisation the way an attacker does, and know which way in they would try first.
Internet-facing estates change every week: a new marketing site, a staging server left online, a cloud host nobody registered. Inventories fall behind, and a list of thousands of CVEs does not say which host actually gives an attacker a way in.
KnightGuard discovers everything reachable under your domain from the outside, with no agents and no credentials. It fingerprints what answers, matches products and versions to known-exploited and published vulnerabilities with a stated confidence, and scores every host for its attack probability: the likelihood, from 0 to 100%, that it gives an attacker initial access. Suppliers and subsidiaries get the same treatment.
Where it works in CTEM
Contribution by stage across the continuous exposure management lifecycle.
Share of this use case's platform capability at each CTEM stage. The five shares sum to 100%. & the cycle repeats continuously
SCOPING
10%Define the estate. Your primary domain, plus suppliers and subsidiaries as third parties. Authorization is recorded the first time a domain is scanned; port coverage and schedule are set per scan.
DISCOVERY
40%Find everything exposed. Subdomains, DNS, IP addresses, open ports and services, with drift between runs. Fingerprints identify technologies and exact versions without authentication.
PRIORITIZATION
25%Rank hosts by likelihood. Every host scored 0 to 100% for attack probability. Decisive evidence sets a floor; mitigation lowers it. Drivers point to the single fix that removes the most risk.
VALIDATION
15%Prove the path is open. Each step on a path carries commands to confirm it; leaked-credential check for logins. Safe, non-destructive validation shows whether an attacker could really execute the route.
MOBILIZATION
10%Route fixes to owners. Due dates from your SLA policy; tickets opened directly in Jira or ServiceNow. When an issue is resolved and rescanned, it closes automatically.
How it works
Each step coloured by its CTEM stage across the complete attack surface lifecycle.
Seed domain
Primary domain and third parties, authorization recorded
Discover
Subdomains, IPs, open ports, services, certificates
Fingerprint & match
Technologies and versions against KEV and NVD
Score each host
Attack probability, 0–100%, from nine attack vectors
Attack path
Internet to host to finding, with checks to confirm it
Ticket & track
SLA due date, Jira or ServiceNow, status sync
Key capabilities
Comprehensive asset discovery, confidence-graded vulnerability analysis, and exposure reduction.
Continuous discovery
Subdomains from passive sources, certificate transparency and permutations; every open TCP port (the top 1,000 or all 65,535) and the service answering on each, across more than 120 protocols.
Confidence you can read
Each vulnerability is rated Confirmed, Likely or Possible by whether evidence matches the advisory, and by who published it: vendor, CISA KEV or monitor-only. Advisory-stipulated evidence (such as a patched release or mitigation setting) is recorded with the finding.
Graded security pillars
Application, DNS, email, infrastructure, web encryption, software patching, endpoint inventory, dark web posture and secret leaks, each graded A to F and weighted into one organisation grade.
Attack probability per host
Nine attack vectors combine into one likelihood. Decisive evidence such as a confirmed known-exploited CVE or a subdomain takeover sets a floor; a CDN or web application firewall lowers it, never to zero.
Drivers: the shortest route down
Every host lists the findings whose fix would lower its probability the most, so the first fix is the one that removes the most risk.
Drift and third parties
Infrastructure Drift shows what changed between scans. Suppliers and subsidiaries are scanned, graded and can be sent their own report on a schedule.
Outside-in discovery
From one seed domain to every exposed host, service and technology, compared scan to scan.
Attack probability and the path in
How a host's exposed services and findings add up to its attack probability, and the fix that lowers it most.
Ready to level up your cyber defence?
Supports modern enterprises with agentic AI discovery, real-time threat validation, and autonomous exposure prioritization.