ASM

ASM is built but not yet deployed: discovery from passive sources, ownership review, monitoring and alerts all exist in the code, and no organization runs it today. We are taking on a small number of design partners and will work closely with each one. What you do not get is the pretence that every edge case is already settled.

A scanner gives you candidates. This gives you an inventory: each candidate is accepted, rejected or marked third-party by a person, the decision is recorded, and what is accepted becomes an asset with an owner that your assessments and findings attach to.

No. Discovery reads public sources (certificate transparency, passive DNS and registration data) and records what they show; it sends nothing to your systems. Testing is a separate activity with its own explicit, versioned authorization — an asset appearing in the inventory is never a reason for anyone to start testing it.

They are marked third-party and stay visible. A partner portal under your brand is still your exposure even when you cannot patch it, so it belongs in the picture — labelled for what it is, and routed to the supplier rather than to your engineers.

Alerts describe change against an accepted baseline, not the state of the world. A hostname seen for two years is not news; a new hostname under your domain, or an address that starts resolving to different names, is. Ownership decides who the alert goes to.

It reappears against the same asset with its history, so you can see it is a regression rather than a new finding. Equally, nothing is recorded as gone because a source failed to answer.

Not in bulk yet: importing a spreadsheet or CMDB export is planned. Today assets are registered through the screens or the integration API, discovery proposes what is missing, and duplicates are merged in a way that keeps the old identifiers and can be undone.

That is how it is designed: for most organizations a complete inventory of their internet-facing systems is itself sensitive, which is a good reason to keep it inside. It is not deployed anywhere yet; operating it for organizations that would rather we did is planned too.

One inventory underneath both. Discovery proposes and your team accepts; assessments are scoped against those same assets and their findings attach to them. Each product is useful alone and they are stronger together.

On a schedule you choose, and on demand when something changes — an acquisition, a migration, a new range. Continuous scanning of everything at maximum frequency sounds thorough and mostly produces noise and blocked addresses.

Access is per organization and per person. A service provider can run many client organizations from one installation without any of them seeing another, and every decision carries the name of whoever made it.

Your domains and address ranges, someone who can decide what belongs to your organization, and an agreement on who receives the alerts. The value is in what you do with what the first campaign finds.