Asset Discovery
Continuous external attack-surface mapping
SICenter continuously maps your external attack surface by polling Certificate Transparency logs, DNS zone walks, and passive BGP feeds every hour. Every subdomain, IP, and cloud endpoint that belongs to your organization is tracked automatically — no manual input required beyond an initial scope declaration.
Key capabilities
- CT log polling every hour surfaces new subdomains within minutes of certificate issuance
- Passive DNS and BGP feeds expand coverage beyond what certificates reveal
- Cloud asset enumeration for AWS, GCP, and Azure public endpoints
- Port scanning and service fingerprinting run on every newly discovered host
- Ownership verification prevents out-of-scope assets from entering your inventory
- Change detection triggers re-prioritization whenever an asset's exposure profile shifts
How it works
When you declare a root domain, SICenter registers it as a scope anchor. The discovery scheduler seeds an initial enumeration job — CT log queries, DNS brute-force against a curated wordlist, and passive resolution from our aggregated feed. Results are deduplicated and cross-referenced against your declared IP ranges before being admitted to your inventory.
Recurring jobs run on the cadence set by your plan tier (weekly, daily, or hourly). Each run is a delta pass: only assets whose state has changed since the previous run are re-fingerprinted. This keeps compute costs bounded while ensuring freshness. Service fingerprints include open ports, TLS certificate metadata, HTTP response headers, and detected technologies.
Every asset carries a confidence score derived from the number of independent signals that corroborate its ownership. Low-confidence assets appear in a review queue rather than the live inventory. Reviewers can confirm, reclassify, or discard them. Confirmed assets are retroactively enriched with historical scan data.
Ready? Start mapping your surface.
No credit card required. Start free, upgrade when you need more.