Attack Surface Monitor

Know how secure your
business is. Continuously.

Your company's digital perimeter, continuously monitored — without a security team. First results in 15 min.

Start monitoring →See how it works

From €249/mo, no VAT charged · No installation · Cancel anytime

Oksa Security — example.com · Last scan 2 hours ago

0/100

Moderate risk

Requires attention

Findings requiring action

Redis database exposed to the internetCriticalFix →

SPF record missing — email spoofing possibleCriticalFix →

TLS certificate expires in 8 daysHighFix →

DMARC p=none — no enforcementMediumFix →

Critical

High

Subdomains

✓

HSTS on

No installation

No authentication attempts

Read-only public endpoint checks

ISO 27001 & NIS2 support

First results ~15 min

How it helps

Three questions,
answered immediately.

When the dashboard opens you know instantly — no training, no security expert needed.

How secure are we?

One number tells it all. Security Health Score 0–100 — weighted, prioritised, plain language.

Score 74 — Moderate

Is anything urgent?

Critical findings surface first. No technical monologue — a clear, prioritised action list every time.

Redis exposed to the internet — fix now

What do we need to do?

Every finding includes a plain-language remediation guide. No terminology — a concrete next step.

Add SPF record to DNS settings

How it works

Four steps. Zero configuration.

No agents, no firewall changes. Type your domain — get results.

Add your domain

Type one address. example.com. Under 30 seconds.

We scan automatically

Subdomains, ports, certificates and public repository exposure. Read-only checks.

Get a clear report

Prioritised list — critical first. Remediation guide included.

Alerts on changes

New service found — alert. Score changes — alert. PDF for management.

What we detect

Everything an attacker
sees — you see first.

Scheduled monitoring of your public attack surface. Read-only checks, including network connections and HTTP requests.

Subdomain Discovery

Certificate Transparency logs and 70+ DNS prefixes. All subdomains found automatically.

Open Ports

17 risk ports: SSH, FTP, Telnet, Redis, MySQL, PostgreSQL, MongoDB, Elasticsearch and more.

TLS & Certificates

Expiry warnings at 14, 30 and 60 days — before your customers notice.

DNS Security

DMARC, SPF and DKIM — the foundation for preventing email spoofing and domain hijacking.

Cloud Storage

AWS S3, Azure Blob, GCS — public listing and sensitive files exposed.

GitHub Secrets

19 key patterns from public repositories. API keys, certificates, connection credentials.

Admin Interfaces

Subdomain Takeover

CNAME chains to unclaimed services. 19 service fingerprints — Heroku, GitHub Pages etc.

Security Headers

HSTS, CSP, X-Frame-Options and Referrer-Policy checked on every subdomain.

Product preview

Dashboard built for
non-security professionals.

The CEO understands it. The CTO loves it. The security expert trusts it.

Oksa Security

Overview

Findings

Domains

Compliance

Reports

example.com

Critical findings

Requires immediate attention

Security Health Score

74/100

Moderate — trend improving

Monitored domains

23 subdomains discovered

Last scan

2h ago

Next: ~4h from now

Priority queue

Critical and high findings first

2 critical

Redis database exposed (port 6379)

db.example.com · Found 3 days ago

SPF record completely missing

example.com · DNS · Found 7 days ago

TLS certificate expires in 8 days

api.example.com · TLS · Expires 31.7.2026

dev.example.com:22 SSH open to internet

dev.example.com · Port 22 · OpenSSH 8.4

Score trend

Last 8 scans

Mon

Tue

Wed

Thu

Fri

Sat

Sun

Lower is better — target below 30

Regulations

Regulators ask.
You have the answer.

Use findings, asset inventories and verification history to support your security controls. Reports do not certify compliance; obligations depend on your organisation and the applicable framework.

NIS2 Art. 21

Network & Information Security

Supports assessment of external exposure as part of cybersecurity risk management. The Finnish Cybersecurity Act took effect on 8 April 2025; applicability depends on your organisation.

Check your organisation’s scope and obligations

DORA Art. 9

Digital Operational Resilience

External asset observations can support ICT risk management for organisations subject to DORA. They do not replace internal inventories or resilience testing.

Part of a wider ICT risk management process

GDPR Art. 32

Technical & Organisational Safeguards

Findings can inform assessment of risks to personal data. A finding is not proof of a personal data breach; notification duties require a separate assessment.

Assess security measures and incident obligations

ISO 27001:2022 A.8.8

Technical Vulnerability Management

Finding history and verification results can support technical vulnerability management. Certification requires a wider management system and an independent assessment.

Supporting evidence, not a certification

Pricing

Built for SMBs.
Priced accordingly.

No long-term contracts. No surprises. Monthly, cancel anytime.

Starter

One company, one domain. Perfect to get started.

€249/mo

No VAT charged

1 domain
Weekly scans
Email alerts
PDF & CSV reports
ISO 27001 & SOC 2 mapping

Get started

Common questions

Is this legal?

Yes. We only read what's already publicly visible on the internet. We don't try passwords, don't send payloads, don't touch target systems. Our user-agent always identifies who we are.

How does this differ from penetration testing?

A pentest is a point-in-time assessment. ASM Scanner repeatedly checks public-facing assets on the schedule included in your plan, so changes can be found between pentests. Pentest and ASM complement each other.

Will it flood me with unnecessary alerts?

No. Every finding is validated before it's shown. A critical alert is sent at most once per day per finding. Low-priority findings appear on the dashboard, not in your inbox.

Does this help meet NIS2 or DORA requirements?

Yes. NIS2 Art. 21 requires asset inventory, continuous monitoring and change management — ASM produces these automatically. The dashboard serves as direct audit evidence.

Is data stored in the EU?

Not all processing stays in the EU. We use hosting and email providers; Resend stores message content and delivery data in the United States. See our Privacy Policy for recipients and international transfers.

Your attack surface is public.
Your visibility into it isn't.

Start monitoring today. First results in 15 min.

Start monitoring — from €249/mo Contact us →

No installationPublic endpoint checksRead-only