Bulk asset import
Normalize and review bounded domain imports before any asset is verified, authorized, or admitted.
For startups
Build a credible external vulnerability routine before the backlog grows
Move from a few verified domains to scheduled scans, clear remediation decisions, and shareable evidence without starting with an oversized security platform.
Three assets free for 14 days. Ownership verification and explicit authorization are required before scanning.
A bounded starting point
Begin with three assets free for 14 days and authorize only targets the organization controls.
Clear next actions
Findings include impact, bounded evidence, and remediation steps designed for a focused workflow.
Controls that scale
Organization roles, quotas, schedules, emergency stops, and audit events remain part of the operating model.
Operating workflow
From explicit scope to a maintained finding record
The product keeps verification, authorization, execution, and remediation as separate decisions.
- 1
Verify the first assets
Add exact public domains and prove control through the supported DNS or HTTPS ownership workflow.
- 2
Run an approved baseline
Confirm the policy and exclusions, then queue an admitted scan or create a schedule within plan limits.
- 3
Close the loop
Assign a finding state, record bounded notes, deploy the change, and verify it with a later observation.
Product fit
A focused external vulnerability workflow
DNS, TLS, and HTTP baseline
Use code-owned checks for public resolution, CAA, certificates, HTTPS redirects, and supported headers.
Controlled expansion
Eligible paid profiles can add approved catalog coverage while preserving exact-target and execution safety controls.
Reports for real conversations
Share a scoped record of observations and remediation status with advisors or customers without overstating assurance.
Know where the workflow fits
A clear boundary makes the automated results easier to use and explain.
Useful when
- A small team needs one owner for public asset and finding hygiene.
- Security review questions are arriving before a dedicated vulnerability-management function exists.
- The organization wants a repeatable external workflow with predictable asset-based pricing.
Plan separately for
- A complete security program, incident response function, or secure development lifecycle.
- Independent penetration tests, compliance audits, legal review, and customer-specific assurance work.
- Unverified third-party infrastructure or broad discovery outside explicitly authorized assets.
Start with a scope your team can own
A small, well-owned scan scope is more useful than a large inventory nobody can remediate. Start with exact assets and build the routine deliberately.
Your first scan is one verified domain away
Three assets free for 14 days. No card required.
Start free