Reconnaissance
Learn what an adversary can find out about you before they try anything. We map the digital exposure you agree to and show where closer testing is worth the time.
What it answers.
- What could an outsider learn about our organization without touching our systems?
- Which of our internet-facing assets do we not know we own?
- Where should a later penetration test or red team spend its time?
What is in scope.
Authorized external reconnaissance and attack-surface review. The exact boundary is written into the authorization before work starts.
- Domains, subdomains and certificates tied to your organization
- Internet-facing hosts, services and cloud storage within the agreed ranges
- Code repositories, paste sites and public documents that mention your systems
- Staff and role information visible on public sources, reviewed at the level of exposure rather than individuals
- Credentials from previously published breach data, checked against your domains
How it runs.
-
Agree the boundary
We confirm which entities, brands and ranges are yours and what we may and may not touch.
-
Collect
Passive collection from public sources, followed by light active checks where authorized.
-
Verify ownership
Each asset is checked against your records before it appears in the findings.
-
Prioritize
We rank exposures by what an adversary could do with them next.
What you receive.
- An exposure map of assets, services and public information linked to you
- Evidence for each finding, with source and date collected
- A short list of targets recommended for closer testing
- A readout for your security and technology leads
What we need from you.
- The legal entities, brands and domains in scope
- Written authorization naming who can approve active checks
- A contact who can confirm whether an asset belongs to you
Choose reconnaissance when you want a clear picture of your external exposure before committing to deeper testing, or after a merger, rebrand or cloud migration.
Find out what is visible from outside.
Write from your organization's email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.