ThingsRecon Attack Surface Discovery is an agentless external discovery capability that identifies internet-facing assets and exposures across an organisation’s digital footprint. It can surface domains, subdomains, IP ranges, applications, certificates, APIs, cloud assets, scripts, mobile applications and forgotten or shadow infrastructure. Discovery is continuous and uses multiple external data sources and regional scanning vantage points. Findings are supported by observable evidence and evaluated using more than 100 cyber hygiene indicators. ThingsRecon also adds relationship and business context, helping teams understand which assets connect to suppliers or critical systems and where remediation will reduce the most meaningful risk. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert.

An Exposure Snapshot is a focused view of an organisation’s externally visible attack surface. Starting from an agreed domain or scope, ThingsRecon discovers internet-facing assets, examines cyber hygiene indicators and highlights exposures that may require validation or remediation. The assessment is performed externally and does not require agents or access to internal systems. The snapshot can help teams compare their known inventory with what is observable from the internet, identify forgotten assets or shadow infrastructure and understand the types of evidence ThingsRecon collects. It is intended as an initial assessment. Continuous Attack Surface Discovery adds ongoing monitoring, change detection, prioritisation and reporting as the external environment evolves. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert.

No. ThingsRecon performs discovery externally and does not require software agents to be installed across the organisation or its suppliers. The platform analyses publicly observable technical signals and conducts non-intrusive scanning from outside the environment, which reduces deployment effort and avoids depending on each supplier to participate. Agentless discovery is especially useful for unknown, unmanaged or third-party assets where the organisation may not have administrative access. It does not remove the value of internal telemetry, asset management or endpoint tools; those sources can provide additional context. ThingsRecon’s role is to show what is visible and connected from an external perspective, attach evidence to the findings and monitor the surface as it changes. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert.

No. ThingsRecon performs discovery externally and does not require software agents to be installed across the organisation or its suppliers. The platform analyses publicly observable technical signals and conducts non-intrusive scanning from outside the environment, which reduces deployment effort and avoids depending on each supplier to participate. Agentless discovery is especially useful for unknown, unmanaged or third-party assets where the organisation may not have administrative access. It does not remove the value of internal telemetry, asset management or endpoint tools; those sources can provide additional context. ThingsRecon’s role is to show what is visible and connected from an external perspective, attach evidence to the findings and monitor the surface as it changes. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert.

ThingsRecon is designed to use non-intrusive external discovery. It examines publicly observable infrastructure and performs controlled scanning without installing agents, authenticating into internal systems or attempting to exploit vulnerabilities. The purpose is to identify assets, configurations, services and relationships that are already exposed to an outside observer. As with any external assessment, scope and authorisation still matter. Organisations should verify the domains or entities being assessed and follow their internal approval processes. Findings indicate externally observable evidence and potential exposure; they should be validated and prioritised in context before remediation decisions are made. This approach gives teams an attacker-relevant view without turning discovery into a penetration test.

ThingsRecon can discover a broad range of externally observable assets, including domains, subdomains, fully qualified domain names, IP addresses and ranges, certificates, applications, URLs, API endpoints, cloud services, scripts, software, headers, cookies, inputs and mobile applications. It can also identify supplier infrastructure and digital relationships connected to those assets. Coverage depends on what is externally visible and on the evidence available for a particular organisation. ThingsRecon combines multiple discovery methods rather than relying on a single source, then validates and attributes findings before presenting them. This helps teams move beyond a known-domain list and identify forgotten infrastructure, shadow applications, inherited assets and third-party connections that may otherwise remain outside the security inventory.

Yes. ThingsRecon can surface externally visible shadow IT, such as unapproved SaaS tools, forgotten applications, test environments, embedded scripts, cloud endpoints and services introduced outside normal procurement or asset-management processes. It does this by analysing the organisation’s external footprint and the connections present in websites, DNS, certificates and related infrastructure. External discovery cannot determine business ownership or approval status by itself. A finding becomes shadow IT only after the organisation confirms that it is unmanaged, unknown or outside policy. ThingsRecon provides the evidence needed for that validation and can continue monitoring confirmed assets or suppliers for changes in exposure, helping security teams bring previously invisible technology into governance.

Yes. ThingsRecon can identify externally reachable API endpoints and related web infrastructure when they are discoverable from public technical signals or connected assets. This can include APIs linked from applications, scripts, documentation, subdomains or observed services, including endpoints that are missing from the organisation’s known inventory. Discovery indicates that an endpoint exists and is externally observable; it does not assume that the API is vulnerable. Teams should validate ownership, intended exposure, authentication and data sensitivity. ThingsRecon can add evidence, technology context and cyber hygiene findings so exposed APIs can be assessed alongside the rest of the attack surface and monitored for changes over time. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert.

ThingsRecon is designed for continuous discovery and monitoring rather than a single annual snapshot. The platform repeatedly scans for new assets, supplier connections, configuration changes and shifts in external exposure, with alerts and reporting used to surface meaningful changes. The exact scan cadence can be configured according to the licensed service and monitoring need. Some data sources change faster than others, so not every attribute updates at the same moment. The important distinction is that the platform maintains a living view and looks for change over time. This supports faster response when a new endpoint appears, a certificate changes, a supplier’s posture deteriorates or a previously unknown dependency becomes visible. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert.

ThingsRecon supports data residency in Europe and North America, allowing organisations to align the service with regional compliance, sovereignty and procurement requirements. The platform performs external discovery from multiple geographic vantage points while keeping customer data within the selected operating region where the service configuration supports it. Data residency should be evaluated alongside data classification, contractual terms, subprocessors, retention and access controls. Organisations with specific regulatory or national requirements should confirm the applicable region and processing arrangements during procurement. Geo-located scanning and data residency solve different problems: scanning location improves visibility of region-dependent exposure, while residency governs where customer data is processed or stored.

Continuous monitoring should detect changes that alter exposure, ownership, connectivity or business impact. Examples include new domains and endpoints, certificate changes, exposed services, software versions, misconfigurations, supplier connections, infrastructure migrations and deterioration in cyber hygiene. For supplier monitoring, it can also include financial, geopolitical, compliance or organisational changes. Not every change is a risk event, so teams need evidence, confidence and relationship context. ThingsRecon continuously observes the external ecosystem and uses Digital Proximity and business context to help prioritise changes that are closest to critical systems. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert.

Attack surface discovery is important because organisations cannot secure assets they do not know exist. Cloud growth, acquisitions, temporary projects, supplier infrastructure and shadow IT continually create internet-facing systems outside central inventories. Discovery gives security teams a current scope for vulnerability management, testing and incident response. ThingsRecon adds continuous external evidence and relationship context so teams can identify unknown assets and understand which exposures matter most. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert. In practice, teams should document scope, ownership, supporting evidence and the action expected when the answer changes. This turns the definition into a repeatable part of security and risk management rather than a one-off explanation.

Deep attack surface discovery uses multiple recursive and contextual discovery methods to find external assets and relationships beyond the obvious domains and IP ranges already known to the organisation. It looks for forgotten subdomains, cloud endpoints, APIs, scripts, mobile applications, inherited infrastructure and supplier connections, then validates and attributes the findings. ThingsRecon combines this broader discovery with more than 100 cyber hygiene indicators, geo-located scanning and Digital Proximity to produce a prioritised view rather than a larger unfiltered asset list. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert. The strongest implementation combines external intelligence with internal knowledge, supplier engagement and documented risk decisions, creating a view that remains useful as the digital ecosystem changes.

Yes. Attack surface discovery can uncover forgotten infrastructure such as old subdomains, test systems, abandoned cloud services, legacy applications and assets inherited through acquisitions. It does this by looking beyond the current inventory and correlating external signals including DNS, certificates, IP ranges and web technologies. The organisation still needs to confirm ownership and whether the asset should remain online. ThingsRecon attaches evidence and continuously monitors validated assets so forgotten systems do not disappear again after the initial review. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert.

No. ThingsRecon performs discovery externally and does not require software agents to be installed across the organisation or its suppliers. The platform analyses publicly observable technical signals and conducts non-intrusive scanning from outside the environment, which reduces deployment effort and avoids depending on each supplier to participate. Agentless discovery is especially useful for unknown, unmanaged or third-party assets where the organisation may not have administrative access. It does not remove the value of internal telemetry, asset management or endpoint tools; those sources can provide additional context. ThingsRecon’s role is to show what is visible and connected from an external perspective, attach evidence to the findings and monitor the surface as it changes. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert.

ThingsRecon is designed to use non-intrusive external discovery. It examines publicly observable infrastructure and performs controlled scanning without installing agents, authenticating into internal systems or attempting to exploit vulnerabilities. The purpose is to identify assets, configurations, services and relationships that are already exposed to an outside observer. As with any external assessment, scope and authorisation still matter. Organisations should verify the domains or entities being assessed and follow their internal approval processes. Findings indicate externally observable evidence and potential exposure; they should be validated and prioritised in context before remediation decisions are made. This approach gives teams an attacker-relevant view without turning discovery into a penetration test.