Protecting businesses in every province and territory
Experiencing a breach? Get help now
Attack surface management
We find every internet-facing system you own, including the ones nobody remembers, and tell you what to close before attackers find it.
CONSOLEDemo tenantSOC online00:00:00 ET3MTExposure / Attack surface
External asset map
33
Assets found
3
New exposures
1
Expiring
6,412
Probes today
prairiesteel.ca
Root domain
staging
New · WordPress 5.8
203.0.113.44
New · 3389 RDP open
portal
Cert expires in 6 days
s3: psf-quotes
New · public listing
Certified partner of
Why this cannot wait
Overview
Attack surface management is the continuous process of finding, inventorying and monitoring every system your organization exposes to the internet. We combine automated discovery with analyst judgement: automation finds, analysts confirm what belongs to you and what actually needs fixing.
You cannot protect what you do not know you have.
On your list
Slipped out of view
Attack surface management covers both columns. Most risk sits in the second.
It changes constantly, and many people can change it. None of it is malicious, and all of it adds up.
What we find
Attackers do not start by picking a target and studying it. They scan the whole internet for a specific weakness, then work through the list of everyone who has it. A Halifax law firm and a Brampton manufacturer end up on the same list because they both left the same service exposed.
01
Still one of the most common ways into small businesses, through password guessing or stolen credentials.
02
Edge devices are heavily targeted when new vulnerabilities are published.
03
Old WordPress installs, staging sites and campaign pages running outdated software.
04
Router, camera, NAS and application management pages reachable from anywhere.
05
Services that should never face the internet but sometimes do after a configuration change.
06
Not an attack in themselves, but a lapsed domain can be bought by someone else, and an expired certificate can take a customer portal offline.
How it works
Discovery runs continuously, with new exposures reviewed by an analyst daily. It works entirely from the outside, using the same public sources attackers use, so we need no access to your systems: only your known domains and IP ranges to start.
We start from your known domains and IP ranges and expand outward. Automation does the volume work.
An analyst reviews what was found and confirms ownership with you: what belongs to the business, what belongs to vendors or former vendors, and what should not exist at all.
Exposures are ranked by real risk, not by a generic severity score. Exposed software versions are checked against vulnerabilities that are being actively exploited, so urgent fixes stand out.
Specific fixes go to your team, your IT provider or your web developer. We confirm each fix worked and keep watching for anything new.
CONSOLEDemo tenantSOC online00:00:00 ET3MTExposure / Attack surface
Unknown assets
Found from outside vs your inventory
33 found · 24 known · 9 unknown
203.0.113.44
Windows Server 2012 R2 · RDP 3389 open
staging.prairiesteel.ca
WordPress 5.8.1 · admin login public · last edit 2023
quotes-old.prairiesteel.ca
CNAME to unclaimed Azure app · takeover risk
pay.prairiesteel.ca
TLS certificate expired November 9, 2026
198.51.100.23:5001
NAS login page reachable from anywhere
Sample screen: assets found from outside that were not in the client’s inventory, and what happened to each.
Priorities and handoff
An exposed RDP port on your accounting server outranks an informational header on a brochure site. These are the findings we see most, with the typical priority and the usual fix.
Many urgent items point to a broader fix. If remote desktop keeps appearing, zero trust and secure access removes the need for it. If websites keep showing up with problems, see website and application security.
Over a year
First month
Discovery usually finds more than anyone expected. The work is mostly sorting: what is ours, what is a vendor’s, what should be shut down. Expect a short list of urgent items and a longer list of housekeeping.
After that
A new subdomain created for a campaign, a firewall rule added for a contractor, a certificate due for renewal or a newly published vulnerability in software you expose. Each alert has a clear owner and fix.
Over time
The number of forgotten systems drops close to zero. Your IT provider and leadership can rely on the inventory, which also helps during an acquisition, an audit or a move to a new hosting provider.
A typical pattern for a 150-person professional services firm in Toronto might be a cluster of urgent fixes at the start, then a few meaningful alerts a month.
CONSOLEDemo tenantSOC online00:00:00 ET3MTExposure / Attack surface
Exposure trend
Open now
6 from 22
Found
50
Closed
58
Median fix
3 days
Open exposures
August 17 to November 9, 2026Per week
FoundClosedSample screen: open external exposures over the first 90 days, with exposures found and closed each week.
Where it fits
ASM tells you what to scan. Vulnerability management tells you what is wrong with it. Penetration testing shows what an attacker could actually do with what we find.
Question 1: this service
“What is out there?”
Continuous and broad. Finds the systems in the first place, including ones missing from your list, and watches the whole internet-facing footprint for new exposures.
You get: An inventory that tells you what to scan and what to test
How discovery worksQuestion 2
“What is wrong with it?”
Goes deeper on systems you already know about, checking each one for weaknesses.
You get: The weaknesses on systems you already know about
Vulnerability managementQuestion 3
“What could an attacker actually do?”
A deep, point-in-time attempt to break in by skilled testers within an agreed scope. ASM makes sure that scope includes everything that is really out there.
You get: A report within 5 business days of testing
Penetration testingIf your entire footprint is one website on a managed platform and Microsoft 365, with no servers, firewall portals or cloud infrastructure, continuous ASM is probably more than you need. A one-time external review and good identity and access management will do more for you.
ASM also does not replace internal security. Most of what attackers do after getting in happens inside your network and accounts, where ASM cannot see. It is one layer, focused on the front door.
Canadian considerations
Canadian insurers and their underwriting partners often run their own external scans of applicants. If they find exposed RDP or an unpatched VPN, it can affect your terms or your renewal. Knowing your attack surface first lets you fix it before they see it.
Insurance readinessA forgotten system holding customer or employee data is still covered by PIPEDA’s safeguarding requirements, and by Quebec’s Law 25 or Alberta’s PIPA where they apply. If one is breached, the reporting obligations are the same as for any other system.
Privacy complianceThe Canadian Centre for Cyber Security regularly publishes alerts about actively exploited vulnerabilities in internet-facing products. ASM is how you know quickly whether one of those alerts applies to you.
General information, not legal advice.
FAQ
Vulnerability scanning checks a list of systems you already know about for weaknesses. Attack surface management finds the systems in the first place, including ones missing from that list, such as an old marketing site, a test server in the cloud or a remote desktop port a vendor opened years ago. ASM tells you what to scan. Vulnerability management tells you what is wrong with it.
A penetration test is a deep, point-in-time attempt to break in, done by skilled testers within an agreed scope. Attack surface management is continuous and broad: it watches your whole internet-facing footprint every day for new exposures. ASM often feeds penetration testing by making sure the scope includes everything that is really out there.
No. Attack surface management works from the outside, using the same public sources and scanning techniques attackers use: DNS, certificate transparency logs and internet-wide scan data. We need your known domains and IP ranges to start, and we ask you to confirm ownership of anything we find so we do not waste your time on assets that belong to someone else.
Shadow IT is technology set up without the knowledge of the people responsible for securing it: a marketing team's landing page builder, a developer's test server, a file-sharing account a project manager opened for a client. It is rarely malicious, but it is often unpatched, unmonitored and protected by a weak password, which makes it an easy way in.
It happens when a DNS record, such as promo.yourcompany.ca, still points to a cloud service you stopped using. An attacker can register that service and serve their own content on your subdomain, which is useful for convincing phishing pages or stealing session cookies. The fix is simple once found: remove or update the stale DNS record.
Sometimes. If you have one website hosted by a reputable provider, Microsoft 365 and no on-premises servers, a one-time review may be enough. If you have a firewall with remote access, a few websites, cloud services or a history of vendors setting things up, continuous monitoring is cheap insurance against the exposure nobody remembered. A one-time external exposure review is also available if you want a snapshot before committing to ongoing monitoring.
Get started
Send us your known domains and IP ranges. We tell you honestly whether continuous monitoring or a one-time external review fits your footprint.