Question 1

What is attack surface management (ASM) and why does SurfaceScan do it differently?

Accepted Answer

Attack Surface Management (ASM) is the continuous process of discovering, classifying, and monitoring all internet-facing assets your organization owns — including ones your team doesn't know about. Legacy scanners give you a static list of CVEs once a quarter. SurfaceScan runs continuously, correlates assets into actual attack paths, and confirms every critical finding is live before sending it to you. You get fewer alerts, but every one of them is real.

Question 2

How does SurfaceScan discover assets I don't know about?

Accepted Answer

We pull from 16+ OSINT sources — passive DNS, certificate transparency logs, autonomous system (ASN) mapping, shodan-style port scanning, GitHub code searches, cloud metadata APIs, and more. Our discovery engine correlates these signals to build a unified external inventory, including shadow IT, forgotten subdomains, acquired subsidiaries, and third-party services that handle your data.

Question 3

What makes a finding "verified live"?

Accepted Answer

A finding is only marked verified when we've confirmed the full attack chain works end-to-end. For exposed credentials, that means we've validated the key or token against the real API endpoint — not just found the string. For misconfigurations, we confirm the vulnerable behavior is reachable and returns the expected sensitive indicator. We never flag a finding based on a bare HTTP 200, a WAF-intercepted response, or a theoretical vulnerability signature.

Question 4

How is SurfaceScan different from a vulnerability scanner like Nessus or Qualys?

Accepted Answer

Traditional vuln scanners need an agent or authenticated network access, only scan what you tell them to, and don't model how an attacker chains exposures together. SurfaceScan is agentless, external, and discovery-first — we find what you didn't know existed, then show the kill chain connecting your exposure to your data. We complement your internal scanner; we don't replace it.

Question 5

Can I run SurfaceScan on assets I don't directly control (subsidiaries, third parties)?

Accepted Answer

Yes. You can scope SurfaceScan to any domain, IP range, or ASN — including subsidiaries, contractors, and key third parties. For vendor risk, we can provide read-only reports to share with supply chain partners without requiring them to deploy anything.

Question 6

Do I need to install any agents or configure firewall rules?

Accepted Answer

No. SurfaceScan is 100% external and agentless. We observe your attack surface the way an attacker would — from the internet. No agents, no network changes, no credentials required to get started. Onboarding takes under 15 minutes: add your root domain(s), and we start mapping.

Question 7

How long does initial asset discovery take?

Accepted Answer

The first discovery sweep typically completes within 2–4 hours for organizations with up to 100 root domains. After that, your surface is monitored continuously. New assets are detected within 24 hours of becoming internet-accessible. We'll alert you when new critical exposures are found.

Question 8

What do I need to provide to get started?

Accepted Answer

Just your root domain(s) — e.g. company.com. We use that as the seed to discover your full external footprint. You don't need to provide an asset list, and you don't need to configure any DNS or firewall settings. For cloud EASM, you'll add a read-only IAM role that gives us visibility into your cloud posture without any write access.

Question 9

How do you ensure SurfaceScan's scanning doesn't disrupt our production systems?

Accepted Answer

Our scanning is designed to be low-impact and non-intrusive. We rate-limit all probes, avoid any destructive or write-path testing, and never send payloads that could cause downtime or data loss. Our verification methodology uses passive signals and safe read-only API calls. We've scanned Fortune 500 environments continuously for over two years without a single production incident.

Question 10

What data does SurfaceScan store? Where is it hosted?

Accepted Answer

We store the metadata about your attack surface — asset records, findings, historical scan data, and your configurations. We do not exfiltrate or retain the contents of exposed files or credentials beyond what is needed to prove a finding is live. All data is hosted on SOC 2 Type II compliant infrastructure in the United States. EU data residency is available on request.

Question 11

Is SurfaceScan SOC 2 certified?

Accepted Answer

Yes. SurfaceScan is SOC 2 Type II certified. Our audit report is available to customers under NDA. We also maintain a shared responsibility matrix and security questionnaire for procurement teams.

Question 12

How do you handle credentials that SurfaceScan discovers?

Accepted Answer

When we discover exposed credentials, we validate them with the minimum necessary API call to confirm they are live, then immediately mark them in our system. We do not store raw credentials beyond the verification step. Customers are notified immediately so they can rotate the credential. The finding is marked as resolved once the credential is invalidated or the exposure is removed.

Question 13

How is SurfaceScan priced?

Accepted Answer

SurfaceScan is priced based on the number of root domains and the scope of cloud integrations. We offer three plans: Startup (up to 5 root domains), Growth (up to 25 domains with cloud EASM), and Enterprise (unlimited domains, dedicated support, custom SLAs). All plans include continuous scanning, attack-path mapping, and verified-live findings. Contact us for a custom quote.

Question 14

Is there a free trial?

Accepted Answer

We offer a free 60-minute demo walkthrough on your actual attack surface (no commitment is needed) — we'll run a live discovery scan during the call and show you real findings from your external footprint. This is better than a generic trial because you see real data, not sample data. Book a demo to get started.

Question 15

Can I get a proof-of-concept before committing?

Accepted Answer

Yes. For Enterprise deals, we offer a 30-day proof-of-concept on your real environment. We'll agree on success criteria upfront and deliver a full attack surface report at the end. Most POCs surface at least one critical finding the customer wasn't aware of.

Question 16

What integrations does SurfaceScan support?

Accepted Answer

SurfaceScan integrates with Jira, ServiceNow, PagerDuty, Splunk, Microsoft Sentinel, Slack, Teams, and more via webhook. We export findings in SARIF, CSV, and JSON formats, and offer a full REST API for building custom integrations into your SOAR or ticketing platform.

Question 17

Can SurfaceScan auto-create tickets for new critical findings?

Accepted Answer

Yes. You can configure alert rules that trigger on severity, asset type, or specific finding categories. When a new critical finding is verified, SurfaceScan can automatically create a Jira ticket, page on-call via PagerDuty, or post to your Slack/Teams channel — with full context, attack-path details, and recommended remediation steps.

Got questions? We've got answers.

Product & Platform

Setup & Onboarding

Security & Privacy

Pricing & Plans

Integrations & Workflow

Still have questions?