Question 1

What is external attack surface monitoring?

Accepted Answer

External attack surface monitoring (also called attack surface management or ASM) is the continuous process of discovering, cataloguing, and assessing all internet-facing assets belonging to an organisation. This includes domains, subdomains, IP addresses, open ports, web services, TLS certificates, and DNS records. SurfaceScan automates this process and alerts you to new risks as they emerge.

Question 2

Do I need to install anything on my servers?

Accepted Answer

No. SurfaceScan is entirely agentless and external. We scan your infrastructure from the outside, exactly as an attacker would. You simply provide your domains and IP ranges, and we handle everything else. There is nothing to install, no firewall rules to change, and no access to your internal network required.

Question 3

How does SurfaceScan help with ISO 27001 audits?

Accepted Answer

ISO 27001 requires documented evidence of regular technical vulnerability assessments (Annex A control 8.8). SurfaceScan provides dated HTML and PDF reports for every scan run, a complete history of findings including when they were first detected, acknowledged, and resolved, and a clear audit trail of all changes. This documentation directly satisfies the evidence requirements that ISO 27001 auditors look for.

Question 4

How often does SurfaceScan run?

Accepted Answer

Depending on your subscription tier, scans run monthly or weekly, automatically, overnight. You can also trigger a manual on-demand scan at any time, for example after deploying new infrastructure or before an audit. Results are delivered to your inbox as soon as the scan completes.

Question 5

What happens when a critical vulnerability is found?

Accepted Answer

You receive an immediate email alert with full details of the finding: the affected host, the vulnerability, its severity, and recommended remediation steps. Critical and high findings are flagged prominently in both the email and the report. You can acknowledge findings, add notes, and track their status through to resolution directly in the platform.

Question 6

Is my scan data kept private?

Accepted Answer

Yes. All scan data is stored securely and is completely isolated per organisation. Your findings, assets, and reports are never shared with other customers or third parties. All data is stored in the European Union, in full compliance with GDPR. Data is encrypted at rest and in transit.

Question 7

What is the difference between SurfaceScan and a traditional vulnerability scanner?

Accepted Answer

Traditional vulnerability scanners require you to know what to scan, then scan it manually. SurfaceScan first discovers assets you may not know about: forgotten subdomains, IP ranges found via certificate transparency, and services discovered through DNS. It then scans all of them automatically. It also tracks the full lifecycle of every finding across scans, so you have a continuous picture rather than a one-off snapshot.

Question 8

When will SurfaceScan be available?

Accepted Answer

SurfaceScan is currently in development and is on track to launch early access in Q3 2026. Register your interest and you will be among the first to get access, at a reduced early access price. We will reach out personally to early access subscribers before the public launch.

Know your attack surface
before attackers do

Your attack surface is larger
than you think

Forgotten infrastructure

Expired TLS certificates

Exposed services and ports

Undetected vulnerabilities

Weak email security

No audit evidence

Continuous monitoring,
zero effort

Discover

Scan

Report

Built for compliance.
Loved by security teams.

ISO 27001 compliance

NIS2 directive

Continuous security monitoring

Frequently asked questions

Be first to know
your attack surface

Know your attack surfacebefore attackers do

Your attack surface is largerthan you think