Attack Surface Monitor

Know how secure your
business is. Continuously.

Your company's digital perimeter, continuously monitored — without a security team. First results in 6 minutes.

Start monitoring →See how it works

From €299/mo · EU-hosted · No installation · Cancel anytime

Oksa Security — example.com · Last scan 2 hours ago

0/100

Moderate risk

Requires attention

Findings requiring action

Redis database exposed to the internetCriticalFix →

SPF record missing — email spoofing possibleCriticalFix →

TLS certificate expires in 8 daysHighFix →

DMARC p=none — no enforcementMediumFix →

Critical

High

Subdomains

✓

HSTS on

No installation

EU-hosted · GDPR compliant

Passive — reads public data only

ISO 27001 & NIS2 support

First results ~6 min

How it helps

Three questions,
answered immediately.

When the dashboard opens you know instantly — no training, no security expert needed.

How secure are we?

One number tells it all. Security Health Score 0–100 — weighted, prioritised, plain language.

Score 74 — Moderate

Is anything urgent?

Critical findings surface first. No technical monologue — a clear, prioritised action list every time.

Redis exposed to the internet — fix now

What do we need to do?

Every finding includes a plain-language remediation guide. No terminology — a concrete next step.

Add SPF record to DNS settings

How it works

Four steps. Zero configuration.

No agents, no firewall changes. Type your domain — get results.

Add your domain

Type one address. example.com. Under 30 seconds.

We scan automatically

Subdomains, ports, certificates, GitHub leaks. Passively, read-only.

Get a clear report

Prioritised list — critical first. Remediation guide included.

Alerts on changes

New service found — alert. Score changes — alert. PDF for management.

What we detect

Everything an attacker
sees — you see first.

Continuous, passive monitoring from nine sources. All read-only, all automatic.

Subdomain Discovery

Certificate Transparency logs and 70+ DNS prefixes. All subdomains found automatically.

Open Ports

17 risk ports: SSH, FTP, Telnet, Redis, MySQL, PostgreSQL, MongoDB, Elasticsearch and more.

TLS & Certificates

Expiry warnings at 14, 30 and 60 days — before your customers notice.

DNS Security

DMARC, SPF and DKIM — the foundation for preventing email spoofing and domain hijacking.

Cloud Storage

AWS S3, Azure Blob, GCS — public listing and sensitive files exposed.

GitHub Secrets

19 key patterns from public repositories. API keys, certificates, connection credentials.

Admin Interfaces

Subdomain Takeover

CNAME chains to unclaimed services. 19 service fingerprints — Heroku, GitHub Pages etc.

Security Headers

HSTS, CSP, X-Frame-Options and Referrer-Policy checked on every subdomain.

Product preview

Dashboard built for
non-security professionals.

The CEO understands it. The CTO loves it. The security expert trusts it.

Oksa Security

Overview

Findings

Domains

Compliance

Reports

example.com

Critical findings

Requires immediate attention

Security Health Score

74/100

Moderate — trend improving

Monitored domains

23 subdomains discovered

Last scan

2h ago

Next: ~4h from now

Priority queue

Critical and high findings first

2 critical

Redis database exposed (port 6379)

db.example.com · Found 3 days ago

SPF record completely missing

example.com · DNS · Found 7 days ago

TLS certificate expires in 8 days

api.example.com · TLS · Expires 31.7.2026

dev.example.com:22 SSH open to internet

dev.example.com · Port 22 · OpenSSH 8.4

Score trend

Last 8 scans

Mon

Tue

Wed

Thu

Fri

Sat

Sun

Lower is better — target below 30

Regulations

Regulators ask.
You have the answer.

NIS2, DORA, GDPR and ISO 27001 require a documented asset inventory and continuous monitoring. ASM produces these automatically.

NIS2 Art. 21

Network & Information Security

Requires documented ICT asset inventory, continuous monitoring and change management. In force from 18.10.2024.

Up to €10M or 2% of turnover

DORA Art. 9

Digital Operational Resilience

Financial institutions: complete ICT mapping and continuous visibility into internet-facing services. In force since 1/2025.

National supervisory authority sanctions

GDPR Art. 32

Technical & Organisational Safeguards

Open database ports or leaked access keys must be documented as risk for personal data. 72h breach notification obligation.

Up to €20M or 4% of turnover

ISO 27001:2022 A.8.8

Technical Vulnerability Management

Auditors expect a continuous process, systematic prioritisation and verifiable remediation. ASM produces direct audit evidence.

Certification suspension

Pricing

Built for SMBs.
Priced accordingly.

No long-term contracts. No surprises. Monthly, cancel anytime.

Starter

One company, one domain. Perfect to get started.

€299/mo

1 root domain
Daily scans
Email alerts
PDF & CSV reports
ISO 27001 & SOC 2 support
Exposure timeline

Get started

Common questions

Is this legal?

Yes. We only read what's already publicly visible on the internet. We don't try passwords, don't send payloads, don't touch target systems. Our user-agent always identifies who we are.

How does this differ from penetration testing?

A pentest is done once or twice a year — as soon as it's finished, infrastructure continues to change. We monitor from the outside, continuously, automatically. Pentest and ASM complement each other.

Will it flood me with unnecessary alerts?

No. Every finding is validated before it's shown. A critical alert is sent at most once per day per finding. Low-priority findings appear on the dashboard, not in your inbox.

Does this help meet NIS2 or DORA requirements?

Yes. NIS2 Art. 21 requires asset inventory, continuous monitoring and change management — ASM produces these automatically. The dashboard serves as direct audit evidence.

Is data stored in the EU?

Yes. All data is stored on EU-based servers. GDPR compliant. Data Processing Agreement available on request. No US dependencies.

Your attack surface is public.
Your visibility into it isn't.

Start monitoring today. First results in 6 minutes.

Start monitoring — from €299/mo Contact us →

EU-hostedPassiveRead-only