Cyber Army · AutoScan
AutoScan™
An attack-surface monitor that shows its evidence.
AutoScan continuously examines the part of an estate that faces the internet — the hosts, services and endpoints an outsider can reach — and reports what it found, with the evidence attached. It is in limited beta with design partners today.
Everything below is a screen recording of the real product running a real scan. No mockups, no reconstructions.
All we need from you is your domain name.
No software to install. No agent, no credentials to hand over, nothing deployed inside your network. You prove the domain is yours, and the first scan runs from the outside — exactly as an attacker would see it.
- Nothing to install
- No credentials shared
- Runs from outside your perimeter
Two things that are harder than they look
It will not scan what it was not authorised to scan
Every domain and address range is entered in a registry with the BASIS recorded — a DNS record proved, a file served, or a signed agreement. Nothing is tested until it is in that registry. The list is the boundary, and it is why a scan cannot wander onto an estate nobody handed over. It is also the answer to the only question that matters afterwards: on what basis did you test this?
A High has to be earned
A finding is rated High or Critical only when something DEMONSTRATED it — a successful probe, or a re-check that reproduced it. An observation on its own is not enough, which is why some alarming-sounding findings sit lower here than they would elsewhere. That rule costs us dramatic numbers and it is the one worth paying for: a report whose High findings are all real is a report somebody acts on, and a tool that cries wolf is a tool that gets ignored by the second week.
What you're looking at
Three views of the same evidence, each answering a different question. They are not duplicates of one another.
- Findings
- One observation: a scanner saw this, on this host, at this time. The raw record, never merged.
- Issues
- One piece of work. Findings that share a cause are grouped here — this is where a ticket, a status or a decision belongs.
- Risks
- What the issues add up to. Where an attack path exists, it is drawn; where none was found, the view says so plainly rather than implying one.
- Critical
- High
- Medium
- Low
- Info
A finding is rated High or Critical only when something demonstrated it — a successful probe, or a re-check that reproduced it. An observation on its own is not enough, which is why some serious-sounding findings sit lower than you might expect.
A walkthrough
Ten short clips, about three minutes in total. These are screen recordings of the real product running a real scan — nothing here is a mockup.
Setting it up
What a workspace scans through
Connections are how AutoScan reaches your estate. Yours is already configured.
The domains it is authorised to scan
Nothing is scanned until it is in this registry and ownership has been proven. The list is the boundary, and it is the reason a scan can never wander onto someone else's estate.
Choosing the model each agent runs on
Worth seeing once so the setting isn't a surprise later.
Running a scan
Starting a DeepScan on demand
The wizard ends on a review step that states exactly what is about to be tested and asks you to confirm you're authorised to permit it. You can close the tab afterwards; the scan keeps running.
Watching it run, scanner by scanner
Each scanner reports its own status and duration while the run is in flight — including the ones that skipped, and why.
Keeping it current
A nightly SurfaceScan
A scan you have to remember to run is a scan that stops happening. Scheduling is the difference between a snapshot and monitoring.
A weekly DeepScan
The pairing is the point: a light sweep every night for change, a thorough one each week.
Reading what came back
Findings, issues and risks
The three tiers in use, and what opening one actually shows you.
Downloading the report
A compliance report for the run, generated from the same evidence the screens show. Keep it confidential — it is a description of how to attack your estate.
Triage: reading the evidence, then deciding
Opening an issue shows what was actually observed — the request, the response, where it was seen. The severity is a claim; everything under it is what lets you check the claim rather than take it on faith.
How to fix it
Steps written for this specific finding, not a generic advisory — including what the fix might break, and what to do instead if something still depends on it.
The on-demand tools
For when you want to check one specific thing without waiting for the next scheduled run — probe a URL, a port or a TLS certificate, look up DNS, test a domain for email spoofing. Every one of them is limited to the domains this workspace has verified.
Where it is today
AutoScan is in limited beta, running scheduled scans against design partners' production estates — nightly for change, weekly in depth. The findings in those workspaces are real, acted on, and occasionally argued with, which is the point of a beta.
We are not taking open sign-ups yet, so onboarding is a conversation rather than a form — but a short one. Send us a domain you own. You prove it is yours, we scan it, and you see your own estate in the views above rather than ours.