Technology
An in-house scanning engine, four analysis models.
An open port is only the starting point. To know whether a vulnerability exists, you have to identify which product is answering on that port, which version it runs, and how it is configured. BeforeTHEM has its own scanning engine and combines the network view with the host view to get that answer.
Scan models
Use one scan model or combine them all.
Each model sees part of the network, and the platform consolidates what each one found into a single inventory.
No credentials
Identifies each service by the protocol it speaks, not just by its port. Covers the entire network, including equipment that cannot run an agent, such as printers, cameras, switches, and PLCs.
With credentials, no agent
Reaches the host over the network using an account stored in the platform's vault. On Windows it queries the registry; on Linux it queries the system over SSH. The result lists installed software, versions, and applied patches.
From inside the host
A lightweight agent for Windows and Linux. It reads the exact version of each piece of software, the hotfixes, the sites published on the server, and the system's security configuration.
Network and agent combined
The network identifies what is exposed, and the agent confirms it from the host itself. A finding seen by both sources gets the highest confidence. A finding contradicted by the version the agent read is removed from the list.
Why hybrid
The network identifies, the host confirms.
On its own, a network scanner produces false positives, because many services respond without revealing their version. On its own, an agent misses everything that can't take an installation. Used together, each one covers the other's blind spots.
- One asset per machine. Network and agent views are merged into the same asset, even when the hostname changes.
- The most precise version wins. Host data fills in what the network identified without a version.
- False positives discarded. If the installed version is outside the affected range, the finding never reaches the list.
- Only the CVEs that apply to version 2.2.21
- Finding outside the version range: suppressed
- Confidence: confirmed by network and host
In-house engine
Built for the internal network, from protocol to report.
Identification by protocol
Dozens of protocol families, from databases to industrial automation. With SMB and RDP, the handshake alone reveals the Windows version and the domain, with no credentials required.
Thousands of detections in a single engine
Known vulnerabilities, exposed configurations, default logins, and checks written by our offensive security team all run on the same declarative engine.
Content that stays current
New detections and vulnerability intelligence reach the customer environment signed and with no manual intervention. If an update fails, the system automatically rolls back to the previous version.
OT and IoT
OT and IoT with a policy of their own.
Automation equipment is sensitive and calls for its own dedicated scanning policy. BeforeTHEM has a set of checks built for this segment that respects each device's limits and recognizes the industrial protocols most widely used in the market.
Active checks
Active checks, under your team's control.
Some exposures can only be confirmed with a controlled access attempt. A factory password still active on a switch or a camera is a common example. These checks ship disabled, and your team decides where to enable them, by scan profile and by asset.
Factory and weak passwords
Tests the default credentials of the vendor identified on each device and, when authorized, a list of weak passwords, across more than 25 service types. The test only confirms access. No command is run and no configuration changes.
Domain accounts protected
Before checking any domain account, the platform reads the failed-attempt counter and skips accounts close to the lockout threshold.
Pace and scope under control
Attempts follow a rate limit, with an automatic pause when a service is slow to respond. Sensitive assets, such as automation equipment, can be left out of scope.
Watch a scan run in a realistic environment.
The demo uses a simulated network with Active Directory, servers, and OT equipment.