Unified security intelligence platform

Outside, inside, and in the code. One platform.

External and internal attack surface, secure code review and live vulnerability intelligence run as one loop — and a pentesting agent replays every finding before anyone is asked to fix it, so you act on what is exploitable rather than on a list of maybes.

  • EASM
  • IASM
  • Code review
  • Vuln intelligence
  • Pentest validation
Request a demo See how it works
Sample data, for illustration.
5
Security disciplines in one console
6
Recon engines orchestrated per scan
4
Compliance frameworks mapped live
100%
Tenant-scoped data and queries
<30 min
From first scan to validated findings

One platform that finds what you expose outside, maps what is reachable inside, reads the code behind both, ranks it against live exploitation data, and proves the fix held.

Not a scanner that hands you a list. A loop that starts at a domain, runs an agent against every vector it finds, ends at a verified remediation, and leaves an audit trail at every step.

Your perimeter is not where you drew it.

None of this is a failure of the security team. It is what happens when an organisation moves faster than its asset register.

Attackers do not need an inventory. They only need the one asset you forgot.

  • Infrastructure

    Hosts nobody owns

    A subdomain from a campaign that ended. Still resolving, still reachable, still yours in the eyes of an attacker.

  • Internal network

    Three hops nobody drew

    One phished laptop, an over-privileged service account, a share left open: the path from a desk to a domain controller exists whether or not anyone has mapped it.

  • Identity

    Credentials already traded

    Staff addresses and passwords sitting in breach collections, long before anyone inside notices a login that should not work.

  • Supply chain

    Code you never wrote

    Most of what ships is a dependency of a dependency. Its flaws become yours the moment you build.

One platform, five dedicated services.

Each one writes into the same asset model, the same worklist and the same audit trail. Nothing has to be stitched together afterwards.

EASM
External Attack Surface Management

Continuously discover every internet-facing asset, detect exposures and leaked data, and turn findings into governed, repeatable remediation. A built-in pentesting agent then validates each attack vector, so you see what is genuinely exploitable from outside rather than a list of maybes.

  • Asset discovery and risk grading
  • Exposure and data-leak monitoring
  • Pentesting agent that validates every attack vector
  • Prioritised findings and remediation
  • Attack graph and compliance mapping
Explore EASM
IASM
Internal Attack Surface Management

Map what an attacker reaches after the first foothold: internal hosts, open shares, stale service accounts and the lateral paths between segments, ranked by how few hops separate each one from a domain admin.

Explore IASM
VI
Vulnerability Intelligence

One live feed of every CVE disclosure, ranked by real-world exploitation likelihood, so you know which threats can actually hurt you.

Explore VI
CODE
Secure Code Review

Several analysis engines merged into one corroborated list, with a suggested change written against your file and a way to prove it worked.

Explore CODE
PENTEST
Agent-Validated Findings

An agent replays each finding against the live target in a rate-capped sandbox and records what it actually achieved. Exploitable, blocked or inconclusive, stated plainly, with the request and response kept as evidence.

Explore validation
Cyber security asset management

CSAM holds both halves against one asset.

EASM answers what you expose. IASM answers what is reachable once someone is already inside. Asked separately they produce two worklists that argue about the same host; CSAM is the console that asks them together.

  • One record per asset. A host carries its internet exposure and its lateral reach on the same row, so neither view can be read without the other.
  • One worklist, ordered across the whole surface. An internal path that starts at an exposed service outranks either half read alone.
  • One owner and one audit trail. The same governance, the same evidence, whichever side of the perimeter the finding came from.
Open the CSAM console Create a CSAM account
EASM · external half
Domains, services, cloud footprint and leaked data — what the asset shows the internet.
IASM · internal half
Hosts, shares, service accounts and the lateral paths — what the asset reaches from inside.
CSAM · one asset model. Both halves on the same record, ranked together.
The agent fleet

Five agents. One worklist.

Each agent owns one discipline and writes into the shared asset model. They hand work to each other: recon finds the host, code review reads what runs on it, intelligence says whether anyone is exploiting it, and validation settles the argument.

Beacon
External recon

Walks the public internet for anything carrying your name — subdomains, certificates, open services, cloud buckets — and reports what changed since the last pass.

Last sweep 128 live assets · +6 new
Lantern
Internal paths

Sweeps the inside of the perimeter and draws the lateral graph: which host reaches which segment, through which account, in how many hops.

Shortest path to domain admin 3 hops
Ledger
Code and supply chain

Reads the source and every inherited dependency behind an asset, merges the engines that agree, and writes the suggested change against your file.

Run delta 11 new · 34 carried over
Tidewatch
Vulnerability intelligence

Watches the advisory record around the clock, de-duplicates it, and raises the handful of CVEs that touch something you actually run.

Matched to your estate 9 of 1,284
Verdict
Pentest validation

Replays each finding against the live target in a sandbox, chains the ones that combine, and attaches the evidence for whatever it managed to reach.

Queue 4 exploitable · 3 blocked
How it works

Five stages, running continuously.

Every service runs the same loop. It starts outside your network, carries on inside it, and ends at a remediation that has been proven, not promised.

  1. 01

    Discover

    Map every host, certificate, header and exposed service that carries your name from the public internet, then the same inside the perimeter: segments, shares and the accounts that cross them.

  2. 02

    Analyse

    Read the source and the supply chain behind each asset, and check every component against the public advisory record.

  3. 03

    Prioritise

    Separate the reachable from the theoretical, corroborate across independent engines, and rank by what an attacker can actually use.

  4. 04

    Validate

    Hand every ranked vector to the pentesting agent, which replays it against the live target in a rate-capped sandbox and records what it reached. Exploitable, blocked or inconclusive.

  5. 05

    Verify

    Rescan after the change and close the item only when the evidence says it is gone. Nothing is marked fixed by assertion.

Stages four and five are the ones most programmes never reach, and the only ones that produce evidence. A finding carries an owner, a deadline and a history. It closes because a later scan can no longer find it, and if it comes back it reopens itself.

Eight capability groups, one console.

Every service writes into the same asset model, worklist and audit trail. A certificate, a leaked credential and a vulnerable dependency are all findings against an owner.

Discovery and exposure

EASM

Automated discovery of domains, subdomains, hosts, IPs, ports and cloud footprint, with change detection and a risk grade that trends over time.

  • Subdomain and asset discovery from a domain alone
  • Live service and port enumeration
  • SSL/TLS inventory: issuer, expiry, protocol and grade
  • Security-header scoring with missing-header detail
  • Web reconnaissance of panels, directories and endpoints
  • Risk grade with historical trend and change detection

Internal surface and lateral paths

IASM

What an attacker reaches once they are already inside: the hosts, the shares, the accounts and the hops between segments, tested rather than assumed.

  • Internal host and service inventory from an authenticated sweep
  • Share and open-port exposure per segment
  • Service-account hygiene: stale, over-privileged, never rotated
  • Lateral-path graph from any foothold to a domain admin
  • Segment reachability tested, so segmentation is proven
  • Patch gaps on internal-only assets, the ones no external scan sees

Leak and identity intelligence

EASM

Exposed secrets, leaked credentials and dark-web mentions tied to your domains, prioritised by real business risk.

  • Corporate identity footprint across public sources
  • Breach exposure matched against known collections
  • Domain-level leak detection, attributed to an owner
  • Access-controlled sensitive values, never shown by default
  • Every view audited, so disclosure is accountable

Vulnerability intelligence

VI

One live feed of every CVE disclosure, merged and de-duplicated, and ranked by exploitation likelihood rather than severity alone.

  • Unified CVE feed, deduplicated across sources
  • Known-exploited catalogue tracking
  • Exploitation-first ranking rather than score alone
  • Proof-of-concept availability, read at request time
  • Ransomware and threat-activity landscape
  • Scheduled digests enriched for your estate

Source code analysis

CODE

Several independent engines merged into one corroborated list, with the data-flow path from input to flaw.

  • Nine risk categories across ten languages and config formats
  • Data-flow analysis: the path from input to the flaw
  • Several engines merged into one corroborated list
  • Run-to-run deltas: new, carried over, no longer raised
  • Paste or drop a file for review without a repository
  • Read-only: nothing is ever written to your code

Supply chain

CODE

Every component, direct and inherited, matched against the public advisory record before a fixed version is recommended.

  • Full dependency graph, direct and inherited
  • Advisory matching per component and version
  • Fixed version confirmed before it is recommended
  • Unpinned dependencies surfaced as their own risk
  • Interactive maps of the estate and of each repository

Pentest validation

Pentest

Every ranked finding is replayed against the live target by the agent, so the worklist carries a verdict rather than a severity score alone.

  • Each vector replayed against the live asset, not simulated
  • A verdict recorded: exploitable, blocked or inconclusive
  • Request, response and artefact retained as evidence
  • Chained vectors attempted, not only single findings
  • Safe mode: no destructive payloads, rate-capped, scope-locked
  • Automatic re-validation once a fix is claimed

Governance and reporting

Platform

Board-ready dashboards, an append-only audit trail and control mapping across ISO 27001, NIST CSF, DORA and GDPR, with live evidence from platform activity.

  • Remediation lifecycle from detected to verified
  • Owner assignment by email, accepted from a single-use link
  • Executive and technical reports, plus PDF, CSV and Excel exports
  • Multi-tenant isolation and role-based access
  • Full audit trail of who saw and changed what
  • Self-hosted: your code and findings never leave

A finding is not closed because someone said so.

Every item carries an owner, a deadline, a verdict and a history. It moves only when the evidence moves it, and if it comes back, it reopens itself.

  1. Detected

    Raised with its location, its severity and why it matters.

  2. Validated

    Replayed by the agent, which records what it actually reached.

  3. Assigned

    Offered to an owner, who accepts it from a single-use link.

  4. Fixing

    Tracked while the change is made, with the clock running.

  5. Rescanned

    The asset is read again at the new commit, not asked about.

  6. Verified

    Closed only because a scan can no longer find it.

Evidence

Reporting an auditor accepts.

The same run produces the board summary and the engineer’s worklist from one dataset, so the two can never disagree.

Point in time

What was true at a given commit, on a given date, with the scope recorded. What was not looked at is stated plainly, because a report that cannot say that is not evidence.

  • Executive report: posture, trend and top risks
  • Technical report: every finding, with its evidence
  • Machine-readable exports for your own pipeline

Change over time

What is new since the last run, what is gone, and what could not be rechecked. They are kept apart because they are three different claims, and only one of them is good news.

  • New, carried over and no longer raised, counted separately
  • Corroboration recorded where engines agree
  • A full audit trail of who saw and changed what

Four commitments.

  1. 01

    Outside-in, then inside-out

    The starting point is a domain, not an asset list. Then the same question is asked from inside: once someone is through, what do they reach?

  2. 02

    Corroborated, not counted

    Independent engines are merged into one list. Agreement between them raises confidence; volume alone never does.

  3. 03

    Validated, not assumed

    A severity score is a prediction. The agent replays the vector and reports what it reached, so the worklist is ordered by what works.

  4. 04

    Proven, not asserted

    Nothing is closed on a promise. The loop ends at a scan that can no longer find the problem.

Deployed in your environment. Your code and your findings stay inside it.

Questions, answered.

What is External Attack Surface Management?

EASM continuously discovers and monitors every internet-facing asset your organisation exposes (domains, subdomains, IPs, services, cloud footprint) and surfaces the exposures an attacker could exploit, before they do.

What is Internal Attack Surface Management?

IASM asks the question EASM cannot: once an attacker is already inside, what do they reach? It inventories internal hosts, services, shares and service accounts, then draws the lateral paths between segments and ranks them by how few hops separate a foothold from a domain admin.

What does the pentesting agent actually do?

It takes each ranked finding and replays it against the live target in a scope-locked, rate-capped sandbox, including combinations that only work when chained. It never runs destructive payloads. Every attempt ends in a recorded verdict — exploitable, blocked or inconclusive — with the request, the response and any artefact kept as evidence, and it re-runs itself once a fix is claimed.

How is tenant data kept separate?

Every target list, exposure metric and query is filtered by the current tenant. Data from one client organisation is never visible from another, and that is enforced on every page of the platform.

Which compliance frameworks are supported?

ISO/IEC 27001, NIST CSF 2.0, DORA and GDPR out of the box, with control coverage mapped live to your platform activity and exportable as an evidence report.

How fast can we get value?

Launch a scan and you get a prioritised findings view in minutes, with the first validation verdicts behind it. There is no long onboarding and no agent to deploy on external assets; internal scanning is the one part that needs a credential and a vantage point inside the network.

See the platform on a scenario close to yours.

A 30-minute walkthrough with an attack-surface expert: your external footprint, one internal path, and a finding the agent validates live.

Request a demo Log in