The Attack Surface tab makes it easy to see exactly what's going on with your perimeter. It includes active and unresponsive targets, changes since the last scan, expiring certificates, and those ports, services, and protocols you expect (but more importantly, don't expect) to be exposed to the internet.

You can see a list of your targets with a filtering pane on the left to allow you to get the information you need.

For each target, you can also see a screenshot of what can be seen when a user navigates to that service on this target. This helps when trying to identify what is running on a specific port, e.g., by examining the login screen.
​

You can also make this screenshot bigger by clicking on the thumbnail image (highlighted above). You can then scroll through the screenshots using the arrow in the bottom right:

On the far right, you can also see the date when the service on each target was first observed, and also when it was last observed. Below each target, you can also see when the next Network scan will run.
​

This page has a search bar and filters, allowing you to be as high-level or as granular as you like.

For targets behind a Web Application Firewall, you have the option to further filter the list by types of firewall and detection results:

You can also organise the results, using this dropdown:
​

The ports included in your Attack Surface depend on your Intruder plan:

You certainly can! You can find details on the TLS/SSL Certificate expiry date for the relevant ports on each of your targets seen underneath the relevant ports, as seen in the screenshot below:

You are also able to filter the list to view targets with either expired or shortly expiring certificates by using the options in the filter pane:

You will also be notified of this within the network scan emails, if configured. You can read more about network scanning here, and also, further information on configuring email notifications can be found here.

Absolutely, click the Export all button:

You sure can! Once an alert is set up, we'll send you an email each time the alert is triggered. To set it up: click the yellow Alerts button in the top right > complete the form, and select Save alert:
​

Click Alerts > Manage alerts:
​

Click the bin icon:

Click Alerts > Manage alerts:
​

Click the one you want to edit:

Make the changes and click Update alert:
​

Head to Settings > Email notifications > scroll down to Attack surface alert notifications and toggle on or off:
​

An example of the email you will receive can be seen below. This email includes a summary of any changes to your targets, details on the total number of hosts and exposed services, as well as information on your SSL/TLS Certificate expiry periods.

If the target listed sits behind a CDN (such as Cloudflare or Cloudfront), we deliberately omit the network data because it actually references the CDN's infrastructure and not your own. If you'd like to know more, please have a read of this article.

If you're interested in what this all looks like in action, feel free to reach out to us via the chatbot, and we'll connect you with the relevant team.