Service · recurring
Watch the surface that changes while you ship.
What it is
Mapping, on a schedule, with a memory
Each cycle starts from the same attack surface mapping as a full test: subdomains, exposed services, certificates, technologies, login portals, storage buckets. Every asset is recorded with its type, its technology and a scope classification.
The difference is the memory. Each run is compared to the one before it for the same targets, so the report leads with what is new and what has disappeared, not with the whole list again. A host that appeared since last month is the first thing you read.
Each cycle
What a cycle delivers
Change report
New assets, removed assets and changed technologies since the last run, each with its scope classification. The short read for the person who has to act.
Re-test of exposed assets
The in-scope services and applications are tested again against the coverage matrix, so a configuration that drifted or a newly exposed panel is caught in the same cycle.
Verified findings only
As in a full test, an analyst reproduces anything the cycle surfaces before it enters the report. A change in the surface is reported as a fact; a weakness is reported only once it is confirmed.
A standing inventory
The asset inventory carries across cycles and becomes the ground truth you can point an auditor or a customer to, kept current instead of rebuilt each time.
What it is not
Honest about the cadence
Monitoring is a recurring assessment, on a cadence you choose, monthly or quarterly. It is not a 24/7 security operations centre and it does not alert within minutes of a change. If a provider promises real-time detection of every change for the price of a scan, read the method twice. What you get here is a deliberate, analyst-verified re-assessment often enough to catch drift before it is found for you.
Monitoring runs under a standing authorization: the same written agreement as a point-in-time test, extended to cover the agreed schedule and the fixed source addresses for the whole term. You can pause or end it at any time.
Start with one test
Monitoring usually begins with a first full external test to set the baseline, then continues on your chosen cadence. Tell us your targets and we will propose both in one scope.
[email protected] +49 162 1320798 Replies in English or German.