Attack-Surface Mapper

Attack Path & Connection Finder

Think like the adversary. From a starting foothold, this finds the shared dependencies whose compromise would reach the furthest across a target — the pivot points worth defending first. And for any two indicators, it traces how they're actually connected, so you can explain the link behind a hunch.

Dependency Blast Radius

Understand the fallout before it happens. Choose any asset and this maps dependencies in both directions: everything that would break if it went down (your single points of failure), and everything it quietly relies on to work (its own supply chain of DNS, mail, hosting, and networks). The resilience view that turns 'what if this fails' into a concrete answer.

Certificate Transparency Asset Discovery

Every HTTPS certificate is logged publicly — and that log is a goldmine for finding assets you forgot you had. This surfaces a domain's certificates (wildcards included), when they first and last appeared, and the sibling hostnames issued alongside them. A clean way to uncover shadow assets and expansion no inventory captured.

AI / Agent Infrastructure Discovery

AI endpoints are becoming their own attack surface. This maps an organisation's externally visible AI and agent infrastructure — the API, model, and agent hosts exposed to the internet — from the outside, with no cooperation needed. A best-effort first look at an emerging and often unmanaged part of the footprint.

Threat Investigation

The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint — the related domains, the real servers behind any CDN, the neighbouring infrastructure — and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check says 'look closer.'

Digital Infrastructure Mapping

Follow the infrastructure back to who really runs it. Starting from one indicator, this works out the true operator — even behind privacy registration — de-cloaks CDN-fronted sites to their real servers, and pivots out to the rest of that owner's estate. The mapping view for research, attribution, and understanding who's really on the other end.

Infrastructure Concentration & Resilience

Resilience and compliance in one view. This grades how concentrated an organisation's infrastructure is — too much riding on one provider, one region, one data centre, one cable landing — surfacing the single points of failure that matter for resilience planning and for fourth-party risk rules like DORA and NIS2.

Sanctions & Counterparty Due Diligence

Know who you're dealing with before you deal with them. This screens a domain, address, or network against sanctions lists and assesses the counterparty's hosting, true owner, jurisdiction, and reputation — the external due-diligence pass for compliance teams, crypto-AML checks, and vetting an acquisition or an exchange before you transact.

Subdomain Takeover Detection

A dangling subdomain — one still pointing at a service you've since torn down — is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.