Por que múltiplos modelos de Machine Learning, e não um único?

Um único modelo concentra decisões heterogêneas — coleta, correlação, classificação, enriquecimento e validação — em uma única função. Modelos especializados por tipo de decisão elevam a confiabilidade de cada inclusão e mantêm a decisão auditável a cada etapa.

O que a camada agêntica adiciona aos modelos de ML?

Decisão. Os modelos produzem sinais classificados e enriquecidos; a camada agêntica os integra, resolve conflitos entre evidências convergentes e divergentes, decide sobre o nível de propriedade e justifica a inclusão. Em vez de a equipe humana fazer essa triagem, ela acontece antes da entrega — substituindo horas de trabalho manual por uma decisão fundamentada.

É preciso instalar agentes ou fornecer listas de ativos?

Não. A descoberta é integralmente externa e parte apenas do domínio raiz da organização. Não há agentes para instalar nem inventários para fornecer — a plataforma opera assim de forma autônoma.Opcionalmente, a CSURFACE integra-se a ambientes de nuvem, WAF, CIEM e outras fontes para enriquecer a análise — integrações que ampliam o contexto, mas não são necessárias para a descoberta funcionar.

Como vocês evitam atribuir um ativo errado à minha organização?

Um ativo só entra no inventário depois de atribuído à organização por correlação de múltiplos sinais independentes e validado pela camada agêntica. Sinais convergentes e divergentes são reconciliados antes da entrega — a decisão de propriedade chega ao painel já fundamentada.

Essa arquitetura substitui o Attack Surface Management?

Não. Ela é o aprofundamento do ASM: a camada de descoberta que torna o inventário mais completo e mais confiável. As duas capacidades operam juntas, sobre o mesmo inventário vivo.

DISCOVERY ARCHITECTURE

Discovery through MACHINE LEARNING combined with agentic layer.

CSURFACE operates specialized Machine Learning models, supervised by an agentic layer that decides on the ownership of each observed object. The result is a deep inventory with minimal technical noise — without agents, starting from the root domain.

Receive preliminary analysis Speak with an expert

THE CHALLENGE

The traditional enumeration sees only the predictable part of the surface

Classical discovery methods rely on expected patterns: common names, declared IP ranges, known lists. They find what follows conventions—but the actual attack surface is also composed of assets that do not follow any pattern at all: temporary environments, discontinued projects, inherited infrastructure from acquisitions, and services published outside any process.

It is precisely in this interval—between what is predictable and what is exposed—that risk outside monitoring concentrates. Expanding discovery beyond the obvious without overwhelming the team with noise is what separates an approximate inventory from a reliable one.

DISCOVERY

From seed to full surface

Starting from a single point of origin, the platform delivers a complete view of the surface — regardless of distribution and country — identifying each asset with Machine Learning and agentic layer.

discovery · illustrative property tree

0Entities

0Assets

0Third parties

Click each step to review it.

0
Point of origin
A single root domain. Nothing else is required from the customer.
1
Entities
The organization and its related entities are resolved — in any country, regardless of distribution.
2
Domains, subdomains, and FQDNs unfold from each entity.
3
Each name resolves to addresses, exposed applications, and services — including shadow IT, legacy, and ephemeral.
4
The exposure that comes through third-party code is mapped in the same way.
Everything connected: tens of thousands of assets, names, services, and third-party relationships — the real complexity of an enterprise operation, organized in a single view.

The result is a live inventory that tracks every change, addition, and removal of the surface — with business relevance for each asset to enable the team to act on what truly matters.

From zero to full control in minutes.

MACHINE LEARNING

Fundamentated property based on convergent evidence.

For each observed asset, multiple independent evidences are reconciled until a decision is substantiated about the asset's ownership and its link to the organization — auditable with every inclusion in the inventory.

Only what withstands reconciliation between evidences reaches the delivered inventory — each inclusion preserves the history that supported the decision.

inventory · external discovery

Asset	Technology	Evidence	Verdict
portal.exemplo.com.br new	Nginx · WordPress	root domain + crawl	0.98 ML CLAIMED
api.exemplo-net.com	Kong · Node.js	TLS certificate + DNS	1.00 AUTO CLAIMED
hml-legado.exemplo.com.br new	Apache · PHP 7.2	subdomain + registration	0.96 ML CLAIMED
cdn.marca-exemplo.com	Cloudflare	page reference + TLS	0.99 ML CLAIMED
vpn.exemplo.com.br	Fortinet	root domain + DNS	1.00 AUTO CLAIMED

BLIND SPOTS

The surface that official inventories do not register

A large part of the real exposure lives outside known lists: assets published outside formal IT processes, environments that no one shut down, old technology without a clear owner. Discovery incorporates these assets into the inventory with the same property ownership decision.

Shadow IT

Services and applications published outside any formal IT process — provisioned by business areas, product teams or suppliers, without passing through central control.

Temporary and validation environments

Assets created for a specific purpose and never shut down — validations, proof of concepts, and test environments that remain exposed long after their function is fulfilled.

Legacy technology

Old systems still in operation, often without a defined owner and maintenance — the asset category where exposure tends to linger unnoticed for the longest.

Third-party published surface

Integrations and services exposed by suppliers in the organization's name, which expand the surface without appearing in any internal inventory.

It is precisely in this interval — between the predictable and the exposed — where risk outside monitoring concentrates. Each of these assets enters the inventory with the evidence that supports the property ownership decision.

CAMADA AGÊNTICA

Sobre os modelos de ML opera um agente que decide.

A camada agêntica é o supervisor dos modelos. Ela analisa os dados enriquecidos e classificados, resolve conflitos entre sinais e decide sobre o nível de propriedade de cada objeto — substituindo horas de triagem manual por uma decisão fundamentada e auditável, antes de o alerta chegar à equipe.

Decisão fundamentada

O agente não rotula com base em um único modelo: ele integra a saída de todos os modelos, pesa evidências e justifica a decisão de propriedade — cada inclusão no inventário é rastreável.

Resolução de conflito

Quando sinais convergentes apontam num sentido e divergentes em outro, o agente reconcilia: descarta o que é ruído, retém o que é informação, registra a decisão.

Triagem antes da entrega

A camada agêntica filtra o ruído antes de o alerta chegar à equipe. O cliente recebe inventário pronto para uso — não trabalho de triagem.

A consequência operacional é direta: as equipes operam sobre um inventário confiável desde a primeira entrega, sem triar achados que não pertencem à organização. O tempo até a primeira ação relevante é medido em minutos.

HOW IT WORKS

From root domain to delivered inventory

Multivariate Evidence Evaluation

Starting from the root domain, each asset is evaluated through multiple evidences until a grounded and auditable ownership decision is made.

Agent-driven Decision Making

The agentic layer makes decisions on the ownership of each observed object, reconciles conflicting signals, and justifies inclusion in the inventory.

Continuous Revalidation

The surface is continuously re-evaluated. New assets and relevant changes enter the inventory with alerts — without accumulated noise.

FREQUENTLY ASKED QUESTIONS

FAQ

Why multiple Machine Learning models, not a single one?

A single model concentrates heterogeneous decisions — collection, correlation, classification, enrichment, and validation — into a single function. Specialized models by type of decision increase the reliability of each inclusion and maintain auditable decisions at every step.

What does the agentic layer add to ML models?

Decision-making. Models produce classified and enriched signals; the agentic layer integrates them, resolves conflicts between convergent and divergent evidence, decides on the level of ownership, and justifies inclusions. Instead of human teams performing this triage, it happens before delivery — replacing hours of manual work with a data-driven decision.

Do I need to install agents or provide asset lists?

No. Discovery is entirely external and part of the root domain of the organization. There are no agents to install nor inventories to provide — the platform operates autonomously.

Optionally, CSURFACE integrates with cloud environments, WAFs, CIEMs, and other sources for enrichment — integrations that expand context but are not necessary for discovery to function.

How do you prevent assigning the wrong asset to my organization?

An asset only enters the inventory after being assigned to the organization by correlation of multiple independent signals and validated by the agentic layer. Convergent and divergent signals are reconciled before delivery — the ownership decision is already substantiated when it reaches the dashboard.

Does this architecture replace Attack Surface Management?

No. It is an enhancement of ASM: the discovery layer that makes inventories more complete and reliable. Both capabilities operate together, over the same live inventory.

See the assets that were out of monitoring.

Enter your company's domain and receive a preliminary analysis of your external exposure. No card, no meeting.

Receive preliminary analysis