Got a security questionnaire about your external attack surface? Here is the answer in 48 hours.

External attack surface discovery is the process of mapping every internet-facing asset an organisation exposes, such as domains, subdomains, open ports, services, certificates, DNS records, and email security settings, so you can see what an attacker sees before they do. It covers assets you may have forgotten, like staging servers, dangling DNS entries, and leftover cloud resources.

Yes. OpenEASD is a free, open-source tool that Cybersecify created and maintains. The source is on GitHub under an MIT licence, so you can self-host the Docker image and run unlimited scans on your own infrastructure at no cost. You can also use our free hosted snapshot: drop your domain, a founder reviews the findings, and we email you the report. There is no paid tier or upsell on the tool itself.

Both options are available. Engineers can pull the source from GitHub and run the Docker image on their own infrastructure, with full control over scheduling and data. If you would rather not run it yourself, use the free hosted snapshot: submit your apex domain, we run the scan on our infrastructure, a founder reviews the results, and you get the report by email within 48 business hours.

It covers the discovery side of what commercial attack surface management platforms do: it finds internet-facing assets, scores what is wrong with them, and on a rescan tells you which findings are new and which are gone since the previous scan. It does not do per-asset licensing, single sign-on, or multi-tenant workflows, so it is not a like-for-like swap for an enterprise platform. If you want a free attack surface scan without a procurement cycle, pull the MIT-licensed Docker image and self-host it, or submit your domain above.

A scan runs a fixed pipeline of 6 vectors backed by 22 tools. It surfaces subdomains and shadow infrastructure, subdomain takeover risks, open ports and exposed services, DNS security gaps including a full DNSSEC chain-of-trust check, email authentication weaknesses across SPF, DKIM, DMARC and MTA-STS plus open mail relay detection, the ASNs and IP ranges registered to your organisation, TLS and SSL misconfigurations, SSH configuration issues, known CVEs prioritised with EPSS exploit-probability scores and CISA KEV actively-exploited flags, domain registration health, live web endpoints and the technologies they run, hardcoded secrets in served JavaScript, corporate logins for your domain appearing in infostealer logs via Hudson Rock, web vulnerabilities, and HTTP security header and CORS problems. Every finding carries a CVSS v3.1 score, a CWE category where one maps, the tool and check that produced it, and every affected endpoint. Findings are ranked from critical to informational.

A passive scan reads public sources only. It queries DNS, certificate transparency, RDAP, archived URL indexes, and ASN registries, and never sends a probe to your infrastructure, so it needs no authorisation and cannot affect your systems. An active scan probes the target directly: it resolves and connects to hosts, scans ports, negotiates TLS, and requests web pages, so it requires that you own the domain or hold written authorisation from the owner. OpenEASD supports both modes natively, and the hosted scan we run for you is active, which is why the form asks you to confirm authorisation.

It might, and yes you would know. Every OpenEASD probe identifies itself with an honest OpenEASD/1.0 user agent that points at this page, so you can allowlist it. If a WAF or edge network blocks part of the scan, the report says so in a scan coverage note with the number of blocked endpoints and a hedged guess at the vendor. That matters because on a blocked surface an empty result means we could not see, not that the surface is clean. The note tells you to allowlist the scanner and re-run if you want full coverage.