Attack surface management that shows you what they see.
Continuous discovery, real exploitation intelligence and audit-ready evidence in one platform. Point it at a domain and it maps outward on its own.
Every host, port and service. Including the forgotten ones.
GapSecure enumerates subdomains from certificate transparency, DNS and passive sources, resolves them to infrastructure, maps exposed services and fingerprints the software behind each one.
- Origin split. Assets the platform found on its own are tracked separately from the ones you supplied. That's your shadow IT, surfaced and owned.
- Full inventory. Domains, IPs, URLs and emails with first-seen / last-seen history and active / retired status.
- Technology fingerprinting. Servers, CMSes, frameworks and CDNs, normalised with CPE identifiers so CVEs match precisely.
- Geographic spread. See where your exposure physically lives, and how it changes over time.
Assessment on your terms.
From passive reconnaissance that never touches the target, right through to deep authorised testing. Pick the depth and see exactly which stages will run. Try it below.
Surface Discovery
Subdomains, IPs and live web services.
Network Exposure
Reachable ports, services and versions.
Application Assessment
Crawls apps for app-layer weaknesses.
Vulnerability Analysis
CVEs, misconfigs and exposure signatures.
Injection Confirmation
Proven SQLi with a reproduction.
Cross-Site Scripting
Context-verified XSS with PoC.
Dependency Risk
Client-side libraries with advisories.
AI Analysis
Model reasons over the whole surface.
Then it tells you what actually matters.
Findings are matched live against the CISA Known Exploited Vulnerabilities catalogue, because a seven that's being exploited today outranks a nine that isn't. Every weakness maps to the adversary techniques it puts within reach.
CVE-2024-3400PAN-OS GlobalProtect command injectionKEV10.0CVE-2021-41773Apache HTTP Server path traversalKEV7.5CVE-2023-4966NetScaler session token disclosureKEV9.4A deterministic mapping from observed weakness classes to the techniques they enable. It shows what an adversary could do with this; it is not a claim that an intrusion happened.
Finding volume
Trend of confirmed findings over time, by severity, so you can prove exposure is shrinking.
Weakness classes
Every finding classified against the OWASP Top 10 with category-specific remediation guidance.
Component inventory
Every fingerprinted component and the CVEs that fan out from it across your estate.
See the chain, not just the link.
Individual findings rarely tell the whole story. GapSecure visualises how an exposed service, a weak web app and a reachable database combine into a path an attacker could actually walk.
Have our red team validate the pathEvery control scored. Every failure explained.
Findings classified against the OWASP Top 10 are mapped to controls across four frameworks. Expand any failing control and the evidence is right there: the findings, the hosts and the fix.
ISO 27001
2022 Annex ASOC 2 Type II
TSC 2017PCI DSS
v4.0CIS Controls
v8PCI DSS 6.3.3Security vulnerabilities are identified and addressedFAILING
A06:2021 Vulnerable & Outdated Components: Apache 2.4.49 (CVE-2021-41773, KEV), jQuery 1.12.4
staging-2.example-domain.io, app.example-domain.io
Maintain an SBOM, patch or upgrade vulnerable components, remove unused dependencies and track referenced CVEs to closure.
ISO 27001 A.8.8 · SOC 2 CC7.1 · CIS 2.2, 7.3
ISO 27001 A.8.24Use of cryptographyFAILING
A02:2021 Cryptographic Failures: TLS 1.0 enabled, missing HSTS
mail.example-domain.io, cdn.example-domain.io
Enforce TLS 1.2+ with strong ciphers and HSTS, disable legacy protocols and rotate weak certificates.
SOC 2 CC6.7 · PCI DSS 3.5, 4.2 · CIS 3.10, 3.11
SOC 2 CC6.1Logical access securityPASSING
No broken-access-control or authentication findings observed on in-scope assets.
Scores cover controls an external assessment can observe. Governance, policy, physical and process controls are out of scope. Our Compliance Audit team covers those.
One click. The document you actually need.
The board brief, the inventory, the auditor's evidence pack, generated from live data, branded, print-ready and exportable as HTML/PDF, CSV or JSON.
Executive Security Posture Brief
Exposure and remediation priorities for leadership.
External Attack Surface Inventory
Every asset, service and technology visible from outside.
Compliance Evidence Pack
Control coverage mapped from assessment findings.
Threat Exposure Brief
Exploited CVEs, fan-out and reachable techniques.
Plus full red team assessment reports with a cover, anchor-linked table of contents, key findings and per-finding detail with reproduction steps.
An analyst that reads every app.
A configured AI model reads each web application (its delivered markup, scripts and response headers) and reasons over the whole enumerated surface to surface evidence-backed weaknesses that signature scanners miss.
- Bring your own model. Claude, OpenAI, Grok, Mistral or Llama, or point it at your own compatible endpoint.
- Cost under control. Monthly budgets and per-scan usage tracking.
- Evidence-backed. Every AI finding cites what it saw, so analysts can verify in seconds.
Continuous discovery
It never stops looking
Your estate changes every week. GapSecure keeps mapping it so a new exposure is found in hours, not at your next audit.
Engineered for security teams.
Real-time streaming
Results stream to the browser as they're found. No refresh, no waiting for the scan to end.
Multi-organisation
Separate workspaces per business unit or client, with an organisation switcher.
Tenant isolation
Every scan, asset and finding is scoped to its owner at the data layer.
Strict scope
Lock assessments to supplied targets, or let discovery follow related assets.
Risk thresholds
Choose which severities are reported so teams see only what they act on.
Remediation workflow
Mark findings open, resolved or accepted, then re-scan to verify.
API-first
Documented REST API with an OpenAPI spec for SIEM, SOAR and ticketing integration.
Deploy anywhere
Use our cloud, or run the full stack on your own infrastructure with one command.
See your attack surface the way an attacker does.
A 30-minute walkthrough on a domain you own. Passive, zero-touch, no install.