Know what you are exposing to the internet, every month, before someone else tells you.

External attack surface discovery is the process of mapping every internet-facing asset an organisation exposes, such as domains, subdomains, open ports, services, certificates, DNS records, and email security settings, so you can see what an attacker sees before they do. It covers assets you may have forgotten, like staging servers, dangling DNS entries, and leftover cloud resources.

Yes. OpenEASD is a free, open-source tool that Cybersecify created and maintains. The source is on GitHub under an MIT licence, so you can self-host the Docker image and run unlimited scans on your own infrastructure at no cost. You can also use our free hosted snapshot: drop your domain, a founder reviews the findings, and we email you the report. There is no paid tier or upsell on the tool itself.

Both options are available. Engineers can pull the source from GitHub and run the Docker image on their own infrastructure, with full control over scheduling and data. If you would rather not run it yourself, use the free hosted monthly scan: submit your apex domain, we run the scan on our infrastructure, a person reviews the results, and your first report arrives by email within 2 business days. After that we scan and report every month, free, and you can stop it at any time by emailing openeasd@cybersecify.com.

It covers the discovery side of what commercial attack surface management platforms do: it finds internet-facing assets, scores what is wrong with them, and on a rescan tells you which findings are new and which are gone since the previous scan. It does not do per-asset licensing, single sign-on, or multi-tenant workflows, so it is not a like-for-like swap for an enterprise platform. If you want a free attack surface scan without a procurement cycle, pull the MIT-licensed Docker image and self-host it, or submit your domain above.

A scan runs a fixed pipeline of 6 vectors backed by 27 tools. It surfaces subdomains and shadow infrastructure, subdomain takeover risks, open ports and exposed services, DNS security gaps including a full DNSSEC chain-of-trust check, email authentication weaknesses across SPF, DKIM, DMARC and MTA-STS plus open mail relay detection, the ASNs and IP ranges registered to your organisation, TLS and SSL misconfigurations, SSH configuration issues, known CVEs prioritised with EPSS exploit-probability scores and CISA KEV actively-exploited flags, domain registration health, live web endpoints and the technologies they run, hardcoded secrets in served JavaScript, secrets committed to your public GitHub repositories, public repository and organisation recon, corporate logins for your domain appearing in infostealer logs via Hudson Rock, breach exposure for your domain, registered lookalike domains built to be confused with yours, web vulnerabilities, and HTTP security header and CORS problems. Every finding carries a CVSS v3.1 score, a CWE category where one maps, the tool and check that produced it, and every affected endpoint. Findings are ranked from critical to informational.

Nothing is scanned. Submitting emails a six-digit code to the work address you entered, which has to be an address at the domain you are asking us to scan, and entering that code shows you can receive mail there. The request then sits with a person: someone at Cybersecify reads it and sets the scan up by hand. No scan starts automatically and no machine acts on a form submission. Your first report arrives by email within 2 business days, and a fresh one each month after that.

Email openeasd@cybersecify.com and ask us to stop, from any address. We stop the scheduled scans, not just the emails, and you do not need to give a reason or a notice period. Every monthly report also carries a way to stop.

Yes, and it is verified before anything is set up. Monthly scans are full active and passive, so the form checks two things rather than trusting a tick box. Your work email has to be at the domain you are asking us to scan, which means nobody can request a scan of a company they have no relationship with. Then we email a six-digit code to that address and you enter it, because a tick box shows only that somebody ticked it while a code received at the domain shows control of a mailbox there. A person reviews the request before the first scan is set up, and you can withdraw authorisation at any time.

A passive scan reads public sources only. It queries DNS, certificate transparency, RDAP, archived URL indexes, and ASN registries, and never sends a probe to your infrastructure, so it needs no authorisation and cannot affect your systems. An active scan probes the target directly: it resolves and connects to hosts, scans ports, negotiates TLS, and requests web pages, so it requires that you own the domain or hold written authorisation from the owner. OpenEASD supports both modes natively, and the hosted scan we run for you is active, which is why the form asks you to confirm authorisation.

It might, and yes you would know. Every OpenEASD probe identifies itself with an honest OpenEASD/1.0 user agent that points at this page, so you can allowlist it. If a WAF or edge network blocks part of the scan, the report says so in a scan coverage note with the number of blocked endpoints and a hedged guess at the vendor. That matters because on a blocked surface an empty result means we could not see, not that the surface is clean. The note tells you to allowlist the scanner and re-run if you want full coverage.