What is external attack surface management?

External attack surface management continuously discovers, monitors and helps reduce the internet-facing assets and exposures associated with an organization.

Does TUT1 perform active scanning?

TUT1 combines passive discovery with active checks available in plans that include active testing. Active checks must be performed only against assets the customer is authorized to assess.

What does TUT1 monitor?

TUT1 monitors external assets, services, TLS posture, known vulnerability signals, credential exposure and look-alike domains according to the selected plan.

Does TUT1 replace a penetration test?

No. Continuous external exposure monitoring complements, but does not replace, a scoped penetration test and human security review.

External attack surface management, before attackers exploit it.

Mapping Internet-facing assets, vulnerabilities, leaked credentials, and phishing domains provides your team with a clear path to reducing risk exposure.

radar Start Now How it works south

Dark hooded cybersecurity figure using a laptop

A 4-step exposure method.

Built by a hacker from years of field experience, shaped into an accessible platform for anyone who needs to understand their external exposure.

language

Step 1

Discover

Map the external attack surface: domains, subdomains, IPs, ports, ASNs and live internet-facing services.

radar

Step 2

Detect

Identify exposed services, certificate issues, weak headers, CVEs and breached credentials tied to the target.

fingerprint

Step 3

Monitor

Keep the same dataset navigable across landscape, maps, certificates and graph views as new evidence appears.

warning

Step 4

Alert

Surface high-signal findings quickly, so critical exposures are easy to spot without digging through raw output.

One platform.
All your data.

AssetsSubdomains, IPs, ASNs, hostnames and ports.

ExposureOpen services, banners, certs and web posture.

RiskCVEs, weak TLS, headers and breached credentials.

ContextMaps, certificates and holistic graph relationships.

visibilityOverview

Start with the exposure that needs attention.

Overview converts the selected domain into a clear inventory of hosts, IP addresses, credential exposure, certificate checks and potential CVE signals. It gives the team one concise place to start validation and ownership review.

TUT1 demo overview with exposure metrics for testdomainxxxxx

landscapeLandscape

Discover the assets you did not know you owned.

Map domains, subdomains, IP addresses, ASNs, live services and certificates in one working inventory. Passive discovery and authorized active checks give the team a practical outside-in view of what is exposed.

TUT1 demo showing the external inventory for testdomainxxxxx

personEmployees

Connect employee exposure to the affected service.

Review masked employee identifiers, associated URLs, password evidence and dynamically indexed dates in one dedicated view. The demo keeps passwords fictional and masked, while showing the evidence needed to begin a controlled response.

TUT1 demo showing masked credential exposure data for testdomainxxxxx

business3rd Parties

Keep shared exposure separate and actionable.

Third-party results are kept apart from employee records so security and vendor owners can assess shared services, confirm relevance and coordinate remediation without mixing identity populations.

TUT1 demo showing masked third-party credential exposure data

groupsCustomers

Handle customer signals with the right context.

Customer indicators have their own review queue, pairing masked identity evidence with the service and index date. This separation supports the response and communication policy appropriate to customer data.

TUT1 demo showing masked customer credential exposure data

pest_controlDark Web

Investigate intelligence signals without losing context.

Dark-web monitoring brings together fictional forum, paste and index mentions for the demo domain. Signals require validation, but the shared context helps investigators judge what deserves action.

verifiedCertificates

Make TLS posture part of the same inventory.

Certificate monitoring groups expiry, subject, protocol coverage and last-indexed evidence by hostname. It makes certificate ownership and configuration review visible beside the external assets they protect.

TUT1 demo certificate monitoring results

mapMaps

See where the public footprint is hosted.

The map turns an asset inventory into geographic context. Reviewers can spot unexpected locations and start an ownership conversation with country, city and service evidence in view.

TUT1 demo map of fictional external assets

hubHolistic

Connect domains, assets and exposure in one graph.

Holistic brings subdomains, IP addresses and related signals into a relationship view. In the demo, labels are already visible so the fictional topology can be understood immediately.

phishingPhishing

Find look-alike domains before they are used.

Phishing monitoring separates the visual look-alike from registration, registrar, nameserver and date evidence. That gives security and brand-protection teams the context to validate a signal before escalation.

TUT1 demo phishing domain monitoring results

summarizeReport

Turn technical findings into a clear next step.

Report turns the current inventory and exposure signals into a concise management-ready summary with recommended actions. Demo data remains explicitly fictional, while the workflow shows how evidence can support remediation.

Platform capabilities

Automated, on every scan — no manual setup required.

language

Passive Enumeration

Subdomain and host discovery from third-party indexes and DNS — no packets touch the target until you ask for an active scan.

gpp_maybe

CVE Vulns

Known CVEs matched passively against fingerprinted services — surfaced from the same discovery pass, before any active probing.

bug_report

CVE Finder

Active scanning across every live host — open ports, running services and known CVEs (critical & high severity) — so you know what's actually exploitable, not just what's exposed.

verified

Certificate & TLS Posture

Full chain validation on every host: expiry, trust, hostname match, weak keys and legacy TLS versions, flagged automatically.

phishing

Anti-Phishing Detection

Homoglyph and look-alike domain generation with live registration checks, so impersonation attempts surface before they're used against you.

key

Breach & Credential Exposure

Compromised credentials tied to your employees, third parties and customers, tracked across known breach data.

schedule

24/7 Monitoring

Continuous watch over your external exposure between scans, so nothing new goes unnoticed.

block

Takedown

Rapid removal of malicious look-alike domains and phishing infrastructure once detected.

skull

Deep & Dark Web Monitor

Ongoing visibility into forums, marketplaces and leak channels where your data and brand get discussed before it reaches the surface web.

Databreach intelligence

Credential-leak coverage built from large-scale indexed breach sources.

database

Daily Leaked Credential Analysis

Searches are checked against a massive credential-leak corpus so exposed employees, third parties and customers can be surfaced quickly.

folder_open

Continuously Indexed Leak Files

Indexed breach files, stealer logs, combolists and dark-web dumps provide context on where credential exposure appears.

speed

Continuous Credential Ingestion

New credential intelligence is continuously ingested and analyzed to surface emerging exposure.

Choose the plan that fits

Start with passive visibility, add continuous monitoring, or activate deeper enterprise testing.

Starter

$29

per month

One domain, up to 25 subdomains, and two scheduled scans per month — plus shareable reports for clients and audits.

check1 domain and up to 25 subdomains
check2 scheduled scans per month
checkGeolocation map of discovered assets
checkPassive subdomain and host discovery
checkPassive port & service discovery
checkCertificate and TLS posture checks
checkPhishing domain monitoring (twice monthly)
checkAI-generated report
check1 year of access to scan results

Choose Starter

Advanced

$100