Business context
Machine learning assigns to each asset what it belongs to, who owns it, where it lives, and how it is exposed.
ASSET MANAGEMENT
Discover every exposed asset of your organization — including what the inventory does not register.
CSURFACE discovers, classifies, and continuously monitors all assets of your organization exposed on the internet — including those that the official inventory does not register. No agents, no lists to provide: just the root domain as a starting point.
THE CHALLENGE
The official inventory covers only a fraction of the actual surface area
The attack surface of an organization grows every day: cloud environments provisioned by engineering, applications and APIs published by product teams, SaaS contracted by business areas, and legacy infrastructure inherited from acquisitions. This growth is faster than any manually maintained inventory.
The result is a gap: the security team protects what they know, while an attacker enumerates everything that is exposed—including what the organization does not know it has. It is in this gap where incidents begin. According to the 2024 IBM Cost of a Data Breach report, conducted by the Ponemon Institute, more than a third of breaches involved unmanaged assets.
DISCOVERY
The discovery that builds the living inventory
All that follows is a single capability — discovery. Starting from a single confirmed root domain and entirely externally, CSURFACE reconstructs the attack surface of the organization and delivers it as a reliable inventory.
01
Starting point
The discovery begins with a single confirmed root domain of the organization. Nothing needs to be installed, no credentials provided, and no access to the customer's infrastructure: all analysis is conducted from outside, as an external adversary would see the organization. This minimal starting point is deliberate and ensures that the result reflects the actual exposure of the organization.
02
Surface expansion
Beyond the predictable, the surface is expanded. The discovery reaches external presence that traditional inventories and processes leave out — temporary environments, discontinued projects, inherited infrastructure from acquisitions, and published services without security review. The purpose goes beyond finding more assets: it brings to light what was exposed and out of sight.
03
Organizational reach
The discovery does not limit itself to the initial domain: it incorporates into the inventory the exposure of related entities within and outside the country. Thus, assets from newly acquired or affiliated units enter the scope before technical integration makes them evident.
04
Evaluation and attribution
Each candidate asset is evaluated by multi-dimensional machine learning that weighs the probability of it belonging to the organization. These models operate a layer of AI, which decides ownership, reconciles convergent and divergent evidence, and justifies each inclusion. The result is a grounded and auditable decision made before the alert reaches the team, with strong reduction in false positives.
05
Living inventory
Only what withstands this reconciliation enters the inventory — a base with minimal technical noise, delivered ready for use. The surface is continuously re-evaluated, and each asset that enters or exits, as well as relevant changes, generates an alert. From the first delivery, all subsequent steps of the security program operate on a reliable base.
CONNECTED VISION
Totally exposed in a single view
Assets, technologies, and the digital supply chain of suppliers in a single connected view of your attack surface.
CONTEXT AND VIGILANCE
After the inventory: business context and continuous monitoring
A reliable inventory is the start. CSURFACE assigns context to each asset, organizes the surface in layers, and maintains it under constant observation — without interruption.
InternalAssets under direct management, within the perimeter.
Managed externalThe public surface that the organization recognizes and manages.
Extended surfaceShadow IT, legacy and ephemeral assets, outside the official inventory.
Supply chainExposure through third-party code and services.
11Internal
2.330Managed external
52Extended surface
401Supply chain
critical exposure in managed external asset
Search
criticalactive exploitationpublic exploitno WAFexposed portoutdated technology
Each technology, version, and exposure can be searched using a proprietary query language.
Relevance and risk
Each asset is scored for relevance to the business, attractiveness to an attacker, and a consolidated risk score.
Continuous monitoring
New assets, certificates, services, APIs with drift and technology change monitoring — continuously tracked without interruption.
TRACEABILITY
Each asset with attributable ownership and auditable discovery path
Every inclusion in the inventory is traceable: the organization to which the asset belongs, the attribution verdict, and the exact path that led to it. Changes on the surface are recorded with history.
| Apex | Asset | Type | Verdict | Evidence | |
|---|---|---|---|---|---|
| ncore.exemplo.com.br | ncore.exemplo.com.br NEW | DOMAIN | 1.00 ML CLAIMED | root domain + DNS | Disavow |
| portal.exemplo.com.br | portal.exemplo.com.br NEW | DOMAIN | 1.00 AUTO CLAIMED | TLS certificate + DNS | Disavow |
| api.exemplo-net.com | api.exemplo-net.com NEW | DOMAIN | 1.00 AUTO CLAIMED | TLS certificate + DNS | Disavow |
| mail.exemplo.com.br | mail.exemplo.com.br NEW | DOMAIN | 1.00 AUTO CLAIMED | TLS certificate + DNS | Disavow |
| app.marca-exemplo.com | app.marca-exemplo.com NEW | DOMAIN | 1.00 USER CLAIMED | reference on page + TLS | Disavow |
| cdn.exemplo.com.br | cdn.exemplo.com.br NEW | DOMAIN | 1.00 ML CLAIMED | subdomain + registration | Disavow |
CLOSING THE LOOP
This live inventory feeds the CTEM cycle
With a known and contextualized surface, risk prioritization, exploit validation, and mobilization come into play — in your flow, with integration to tickets, SIEM, and market platforms.
FREQUENTLY ASKED QUESTIONS
FAQ
Does CSURFACE require agents or credentials?
No. Discovery is entirely external. The only starting point is the organization's root domain — we do not install agents nor require access to the internal network, and the platform operates autonomously.
Optionally, CSURFACE integrates with cloud environments, WAFs, CIEMs, and other sources to enrich analysis — integrations that expand context but are not necessary for the platform to function.
How long until the first inventory?
The first assets appear in just a few hours and coverage consolidates within the first days — without the traditional scanner deployment and configuration cycle.
How do you avoid false positive ownership?
An asset only enters inventory after being attributed to the organization through correlation of multiple independent signals. Validation occurs before the asset reaches your dashboard.
Does discovery cover cloud and related entities?
Yes. The external exposure of cloud environments and organization-related entities is included in the same inventory.
See what is exposed in your attack surface.
Enter your company domain and receive a preliminary analysis of your external exposure. No card, no meeting.
Receive preliminary analysis