External attack surface monitoring
Know the moment your attack surface changes.
Attack Surface Scan checks the outside of the systems you already run (certificates, security headers, DNS, and what is listening), then keeps checking, and tells you when something moves. New subdomains, expiring certificates, ports that opened overnight. No agent to install, no code to change.
No card required to start. Plans from $25/month; cancel any time.
One score to watch, a report you can hand to anyone
The dashboard shows your posture and what moved since last scan. Every scan can also be exported as a branded PDF, ready for a client, a boss, or an auditor without editing a thing.
What gets checked
HTTP security headers
HSTS, CSP and frame-ancestors, X-Content-Type-Options, Referrer-Policy, permissive CORS, cookie flags, and whether http quietly serves content instead of redirecting.
TLS and certificates
Chain validity and trust, how close expiry is, negotiated protocol, whether TLS 1.0/1.1 still answer, key strength, and hostname/SAN coverage.
DNS and subdomains
SPF and DMARC policy strength, CAA, and subdomain discovery from certificate transparency logs, including dangling CNAMEs pointing at services someone else could claim.
Fingerprint and exposed services
What your stack tells the world about itself, plus a TCP connect check of common ports to flag anything answering that should not be.
Findings are scored from critical down to informational and rolled up into a single 0–100 posture number, so you can tell at a glance whether last week's change made things better or worse.
And then it keeps watching
A one-off scan tells you what is wrong today. Infrastructure drifts, so Attack Surface Scan re-checks on a schedule and tells you what moved, which is the part you cannot get by running a tool once.
New subdomains nobody told you about
Preview deployments, contractor microsites and forgotten staging boxes appear in certificate transparency logs the moment they get a cert. You find out that week, not during an incident.
Certificates before they expire
Renewal warnings at 30, 14, 7 and 3 days, plus an alert if a certificate is ever issued for your domain by a CA you do not use.
DNS that changed when it shouldn't have
An unexpected NS or MX change is what account takeover looks like from the outside. An SPF record that quietly got broader is how spoofing starts.
Services that appeared overnight
A database port answering the internet is worth knowing about today, not next quarter.
Domains that look like yours
Typosquats and homoglyph registrations are the raw material for phishing and invoice fraud. Watched with public DNS and CT data only.
Your own registration lapsing
A domain that expires is worse than any misconfiguration. We track the registry record and warn you well ahead.
Critical changes are sent the moment they are found; everything else is batched into one weekly digest. Findings you have already dealt with can be muted or accepted with a review date, so the digest stays short enough to keep reading.
+ v=spf1 include:_spf.google.com -all
How it works
Add your domain
Takes about a minute: no agent to install, no code to change.
Attack Surface Scan checks it
The first scan finishes in about a minute, then re-runs on a schedule so you hear about changes, not snapshots.
Get findings you can act on
Every finding has a severity, the evidence behind it, and the specific change that fixes it.
Attack Surface Scan + AI
Your AI already works here
Attack Surface Scan meets your AI where it is. Every scan hands its fixes to a coding agent as a paste-ready prompt, and the hosted MCP server lets your assistant run Attack Surface Scan itself: scans, changes, triage and reports, straight from chat.
Hand the fixes to your coding agent
Most findings are small config changes that live in a repository: exactly what coding agents are built for. One click turns any scan into a hand-off pair: the PDF report plus a paste-ready prompt listing every open finding with its evidence, the suggested fix, and the verification step the agent must state before calling it done. Works with Claude Code, Codex, opencode or whatever agent you run.
Severity-ordered, evidence inline
The prompt lists findings worst-first with the scanner's evidence, so the agent spends its effort where it matters, and findings you've muted or accepted are left out.
Honest about what's not in the repo
Fixes that live at the registrar or in a hosting console come back as a flagged checklist with the exact change to make, instead of a hallucinated file edit.
Verified from the outside
Every finding carries a verification command. You review the diff, deploy, run the checks, and the next scan confirms the score moved.
The full hand-off prompt is included with every paid plan; the free trial shows a one-finding preview. How the workflow plays out in Claude Code, Codex and opencode is covered in the hand-off guide.
Or just ask: the MCP server
Connect Claude, ChatGPT, Codex or any MCP client to your account and your attack surface becomes something you can question.
The whole product as tools
Eighteen tools cover the workflow end to end: scan, findings, change feed, triage, PDF reports, and client workspaces with white-label branding on MSP plans.
high: the TLS certificate on api.example.com expires in 12 days, and it hasn't changed since May, so renewal automation may have stalled.
medium: the domain registration for example.io lapses in 24 days (Namecheap).
Endpoint and step-by-step setup for Claude, ChatGPT, Codex, Hermes, Manus, OpenClaw and other clients in the MCP server guide.
Evidence for your next audit
SOC 2 and ISO 27001 auditors don't just ask whether you monitor your external infrastructure. They ask you to prove it operated all year. Attack Surface Scan produces that proof as a side effect of running: scheduled scans with full history, an alert trail, and dated PDF reports you can hand over as-is.
SOC 2
The Common Criteria expect you to monitor infrastructure for vulnerabilities and configuration change (CC7.1) and to evaluate that monitoring (CC4.1). A year of scheduled scans, alerts, and resolved findings is that control operating, across the whole audit period and not just the week before fieldwork.
ISO 27001
Annex A 8.8 asks how you manage technical vulnerabilities and A.5.7 asks where your threat intelligence comes from. Scan history plus CT-log subdomain discovery and lookalike-domain watching answer both with dated records instead of a described process.
Security questionnaires
“Do you perform external vulnerability scanning?” appears on nearly every vendor review. Attach last week's PDF (scope, findings, severities and date on the first page) instead of writing a paragraph an assessor has to take on faith.
Point-in-time proof
Every scan is kept, and any of them exports as a branded, dated PDF. When an auditor asks what your posture was in March, you send March's report rather than reconstructing it.
Honest scoping: Attack Surface Scan is monitoring evidence for a handful of controls, not a compliance program. It does not replace a penetration test, and it is not a PCI ASV scan. It covers the "continuous external monitoring" row of your controls matrix, and covers it well. Full control-by-control mapping in the audit evidence guide.
Run security for clients? Put your name on it.
MSPs and agencies answer for their clients' security every day. The MSP plan puts the same continuous monitoring behind your brand: every client estate in one console, reports carrying your logo, alerts routed per client into your ticketing, and one flat price: $149/month across 25 domains.
Frequently asked questions
What is external attack surface monitoring?
External attack surface monitoring (also called EASM) is the practice of continuously checking what your organization exposes to the public internet (domains, subdomains, TLS certificates, DNS records, HTTP security headers and open ports) and alerting you when something changes. Unlike a vulnerability scanner, it looks at your infrastructure the way an outside attacker would: from the internet, with no credentials and no agent installed.
Does Attack Surface Scan require installing an agent or changing code?
No. Attack Surface Scan is entirely external and passive. You add a domain and Attack Surface Scan observes only what is already visible from the public internet: HTTP response headers, the TLS handshake, public DNS, certificate transparency logs, and whether common ports accept a connection.
Is scanning with Attack Surface Scan safe for production systems?
Yes. Every check is passive: Attack Surface Scan reads headers, completes a normal TLS handshake and queries public DNS, the same traffic any browser or mail server generates. There is no fuzzing, no exploitation, no authentication attempts and no load testing, so it cannot disrupt a production system.
Can I scan any domain with Attack Surface Scan?
No, only domains you control. Each domain passes a quick ownership check before any scan runs. Attack Surface Scan is deliberately built so it cannot be pointed at someone else's infrastructure.
How is Attack Surface Scan different from a one-off scanner like SSL Labs or Security Headers?
Free graders like Qualys SSL Labs or securityheaders.com give you an excellent snapshot of one thing at one moment. Attack Surface Scan runs those categories of checks together (TLS, headers, DNS, email authentication, exposed services and subdomain discovery) on a schedule, keeps history, and alerts you when something changes. The change detection is the part a one-off scan cannot give you.
Can Attack Surface Scan reports be used as evidence for SOC 2 or ISO 27001?
Yes, as evidence that you continuously monitor your external attack surface, which is what SOC 2 CC7.1 and ISO 27001 Annex A 8.8 ask for. Attack Surface Scan keeps every scheduled scan and alert, and any scan exports as a dated PDF, so you can show the control operating across the whole audit period. It complements rather than replaces a penetration test, and it is not a PCI ASV scan.
Can a coding agent like Claude Code fix Attack Surface Scan's findings?
Yes. Most external findings are small config changes that live in a repository, which is exactly what coding agents handle well. Every completed scan has a one-click hand-off that downloads the PDF report and generates a paste-ready prompt for Claude Code, Codex, opencode or any other agent: findings sorted by severity with evidence and suggested fixes, plus a verification step per finding. Fixes that live outside the repo (registrar DNS, a hosting console) come back as a flagged checklist for a human.
Can I connect Attack Surface Scan to Claude or ChatGPT?
Yes. Attack Surface Scan ships a hosted MCP server at mcp.attacksurfacescan.com/mcp that works with Claude, ChatGPT (developer mode), OpenAI Codex, Claude Code, Cursor, Hermes, Manus, OpenClaw and any other MCP client that supports remote servers. The connection uses standard OAuth (no API keys) and the assistant can run scans, read findings, watch the change feed, triage and generate reports, only against domains your account has verified. Setup guide →
Can MSPs or agencies offer Attack Surface Scan to their clients?
Yes. The MSP plan ($149/month) is built for exactly that: monitor every client estate from one console, put your own logo and name on the PDF reports your clients receive, group domains into client workspaces, and route each client's alerts to their own channel. It covers 25 domains with unlimited scans and daily scheduled scanning. See the MSP page for details.
How much does Attack Surface Scan cost?
Plans start at $25/month, with two months free on annual billing. Every plan starts with a 7-day free trial and no card is required to begin. See the pricing page for what each plan includes.
Latest from the blog
Comparisons, how-tos and plain-language explainers on what the outside world can see about your infrastructure.
The Best DMARC Monitoring Tools in 2026 (Free and Paid)
The best DMARC monitoring tools compared: free analyzers from Postmark and Cloudflare, paid platforms like dmarcian and EasyDMARC, and open source parsedmarc.
Read article →The Best SSL Certificate Monitoring Tools in 2026
The best SSL certificate monitoring tools compared: free options, open source (Zabbix, blackbox_exporter), dedicated monitors and enterprise CLM platforms.
Read article →The Best Open Source Attack Surface Management Tools in 2026
The best open source attack surface management tools: Amass, Subfinder, httpx, nuclei, testssl.sh, OpenVAS and more. What each does and how to chain them.
Read article →What Does Attack Surface Management Actually Cost in 2026?
Attack surface management pricing in 2026: the four models, real ranges from $25/month to six figures, the costs vendors leave out, and how to size a budget.
Read article →47-Day TLS Certificates: The Schedule, and How to Be Ready
TLS certificate lifetimes drop to 100 days in 2027 and 47 in 2029. The CA/Browser Forum schedule, why it is happening, and what breaks if you renew by hand.
Read article →EASM vs. CAASM vs. CSPM: The Acronyms, Untangled
EASM looks inward from the internet, CAASM aggregates the tools you already run, and CSPM audits cloud config. What each acronym means and which one you need.
Read article →Find out what is exposed.
Add your domain and have your first report in a couple of minutes.
Start your 7-day trial