Shadow IT
Services and applications published outside any formal IT process — provisioned by business areas, product teams or suppliers, without passing through central control.
DISCOVERY ARCHITECTURE
Discovery through MACHINE LEARNING combined with agentic layer.
CSURFACE operates specialized Machine Learning models, supervised by an agentic layer that decides on the ownership of each observed object. The result is a deep inventory with minimal technical noise — without agents, starting from the root domain.
THE CHALLENGE
The traditional enumeration sees only the predictable part of the surface
Classical discovery methods rely on expected patterns: common names, declared IP ranges, known lists. They find what follows conventions—but the actual attack surface is also composed of assets that do not follow any pattern at all: temporary environments, discontinued projects, inherited infrastructure from acquisitions, and services published outside any process.
It is precisely in this interval—between what is predictable and what is exposed—that risk outside monitoring concentrates. Expanding discovery beyond the obvious without overwhelming the team with noise is what separates an approximate inventory from a reliable one.
DISCOVERY
From seed to full surface
Starting from a single point of origin, the platform delivers a complete view of the surface — regardless of distribution and country — identifying each asset with Machine Learning and agentic layer.
0Entities
0
0Assets
0Third parties
MACHINE LEARNING
Fundamentated property based on convergent evidence.
For each observed asset, multiple independent evidences are reconciled until a decision is substantiated about the asset's ownership and its link to the organization — auditable with every inclusion in the inventory.
Only what withstands reconciliation between evidences reaches the delivered inventory — each inclusion preserves the history that supported the decision.
| Asset | Technology | Evidence | Verdict |
|---|---|---|---|
| portal.exemplo.com.br new | Nginx · WordPress | root domain + crawl | 0.98 ML CLAIMED |
| api.exemplo-net.com | Kong · Node.js | TLS certificate + DNS | 1.00 AUTO CLAIMED |
| hml-legado.exemplo.com.br new | Apache · PHP 7.2 | subdomain + registration | 0.96 ML CLAIMED |
| cdn.marca-exemplo.com | Cloudflare | page reference + TLS | 0.99 ML CLAIMED |
| vpn.exemplo.com.br | Fortinet | root domain + DNS | 1.00 AUTO CLAIMED |
BLIND SPOTS
The surface that official inventories do not register
A large part of the real exposure lives outside known lists: assets published outside formal IT processes, environments that no one shut down, old technology without a clear owner. Discovery incorporates these assets into the inventory with the same property ownership decision.
Temporary and validation environments
Assets created for a specific purpose and never shut down — validations, proof of concepts, and test environments that remain exposed long after their function is fulfilled.
Legacy technology
Old systems still in operation, often without a defined owner and maintenance — the asset category where exposure tends to linger unnoticed for the longest.
Third-party published surface
Integrations and services exposed by suppliers in the organization's name, which expand the surface without appearing in any internal inventory.
It is precisely in this interval — between the predictable and the exposed — where risk outside monitoring concentrates. Each of these assets enters the inventory with the evidence that supports the property ownership decision.
AGENTIC LAYER
Above the ML models sits an agent that decides.
The agentic layer supervises the models. It reads the enriched, classified data, resolves conflicts between signals and decides the ownership level of each object, replacing hours of manual triage with a reasoned, auditable decision before the alert reaches the team.
Reasoned decision
The agent does not label from a single model. It combines the output of every model, weighs the evidence and justifies the ownership call, so each entry in the inventory is traceable.
Conflict resolution
When converging signals point one way and diverging ones another, the agent reconciles them: it drops the noise, keeps the information and records the decision.
Triage before delivery
The agentic layer filters the noise before the alert reaches the team. The client receives an inventory ready to use, not a triage backlog.
The operational consequence is direct: teams work from a trustworthy inventory from the first delivery, with no need to sift findings that belong to somebody else. Time to the first meaningful action is measured in minutes.
HOW IT WORKS
From root domain to delivered inventory
01
Multivariate Evidence Evaluation
Starting from the root domain, each asset is evaluated through multiple evidences until a grounded and auditable ownership decision is made.
02
Agent-driven Decision Making
The agentic layer makes decisions on the ownership of each observed object, reconciles conflicting signals, and justifies inclusion in the inventory.
03
Continuous Revalidation
The surface is continuously re-evaluated. New assets and relevant changes enter the inventory with alerts — without accumulated noise.
FREQUENTLY ASKED QUESTIONS
FAQ
Why multiple Machine Learning models, not a single one?
A single model concentrates heterogeneous decisions — collection, correlation, classification, enrichment, and validation — into a single function. Specialized models by type of decision increase the reliability of each inclusion and maintain auditable decisions at every step.
What does the agentic layer add to ML models?
Decision-making. Models produce classified and enriched signals; the agentic layer integrates them, resolves conflicts between convergent and divergent evidence, decides on the level of ownership, and justifies inclusions. Instead of human teams performing this triage, it happens before delivery — replacing hours of manual work with a data-driven decision.
Do I need to install agents or provide asset lists?
No. Discovery is entirely external and part of the root domain of the organization. There are no agents to install nor inventories to provide — the platform operates autonomously.
Optionally, CSURFACE integrates with cloud environments, WAFs, CIEMs, and other sources for enrichment — integrations that expand context but are not necessary for discovery to function.
How do you prevent assigning the wrong asset to my organization?
An asset only enters the inventory after being assigned to the organization by correlation of multiple independent signals and validated by the agentic layer. Convergent and divergent signals are reconciled before delivery — the ownership decision is already substantiated when it reaches the dashboard.
Does this architecture replace Attack Surface Management?
No. It is an enhancement of ASM: the discovery layer that makes inventories more complete and reliable. Both capabilities operate together, over the same live inventory.
See the assets that were out of monitoring.
Enter your company's domain and receive a preliminary analysis of your external exposure. No credit card.
Receive preliminary analysis