Discover and monitor your external attack surface so you can find risks early, fix misconfigurations, and keep your business secure.
No credit card required.
Certificates, DNS, mail authentication, reputation and open ports, scanned from outside your network three times a day. You are told when something changes, not on every scan.
Learn more about attack surface monitoring →Continuous attack surface monitoring helps you reduce risk, prevent incidents, and stay compliant.
Every asset gets the same checks three times a day: TLS certificate and chain, DNS and mail records, SPF/DMARC enforcement, and Spamhaus blocklist reputation. Public data only — nothing touches your servers.
Prove you control a host — a DNS TXT record, a well-known file, or one curl from the box —
and open-port monitoring turns on: ~35 common ports, and a hard flag on anything that should never
face the internet (RDP, SMB, bare databases).
The first scan is the baseline; after that you hear when something appears or clears — a port opening, a chain breaking, an IP landing on a blocklist. One open port never becomes three pages a day.
-all)
rather than soft-failing.These are the same signals the big attack-surface platforms sell — the difference is you can be watching your first domains five minutes from now, free, and the same system carries all the way up: escalation ladders on every plan, on-call rotations on Team, and on Enterprise your BYO-AI agent receives every exposure alert as a structured envelope and investigates before you're awake. MSPs and platform teams run every client domain in one workspace with per-asset alert routing.
Not without proof. Certificates, DNS, mail auth and reputation are public records — those run on any domain you add. Port scanning sends traffic to the host, so it only runs on assets whose ownership you've verified, and it probes a fixed, bounded list — not an exhaustive sweep.
Public domains, hostnames, and public IP addresses. Private ranges and internal-only names can't be seen from the internet — cover those with the agent and normal uptime monitors in the same account.
The free plan includes 3 exposure assets with full alerting, alongside your uptime monitors. Paid plans raise the asset count and start at $9/mo. See pricing →
It's the other half. Uptime tells you when the site stops answering; Exposure tells you when what it's showing the world changes — an expiring chain, a hijacked record, a port that shouldn't exist. One account, one place that pages you, for both.
Nothing to install. No credit card.