Attack surface
Know what is exposed to the internet before someone else finds it first.
Nexus Atlas discovers, enumerates and validates the domains, hosts and services your organisation exposes externally, and reports what it finds on a schedule you control. Exploitation is not part of what Atlas does; it stops at validated discovery.
- discovery, not a one-time scan
- Continuousdiscovery, not a one-time scan
- findings, not raw scanner output
- Validatedfindings, not raw scanner output
- reporting for an operations team
- Rankedreporting for an operations team
- discovery and reporting only
- No exploitationdiscovery and reporting only
The buyer problem
Nobody has a current list of everything your organisation exposes externally.
Domains get registered outside procurement. A staging environment stays reachable after a project ends. A misconfigured service ships with a default port left open. Each of these is invisible to a team that only tracks what it deliberately provisioned, and each is exactly what an attacker looks for first.
Point-in-time penetration tests catch a snapshot, but the external surface changes weekly as teams stand up new services. A solution needs to run continuously, not once a year.
What changes
From an annual snapshot to a maintained, validated inventory.
Before
- An external inventory that is accurate on the day it was compiled
- Shadow assets discovered by accident, often after an incident
- Raw scan output that still needs manual triage before it is useful
After
- A discovery run repeats on a schedule, keeping the inventory current
- Newly exposed assets surface as part of routine reporting, not incident response
- Findings arrive validated and ranked, ready for a team to act on
How it works mechanically
Discover, enumerate, validate, report, recheck.
- Stage 01
Discover
Find what is exposed
Domains, subdomains, IP ranges and services associated with your organisation are identified, including assets registered outside a central inventory.
- Stage 02
Enumerate
Detail each asset
Each discovered asset is profiled: open ports, running services, software versions and known configuration exposed to the internet.
- Stage 03
Validate
Confirm what matters
Findings are checked to reduce false positives, so the resulting list reflects assets and exposures that are actually present rather than a raw scan output.
- Stage 04
Report
Deliver an actionable list
Validated findings are compiled into a report ranked for an operations team to act on, with the asset, exposure and source of discovery recorded.
- Stage 05
Recheck
Run again on a cadence
Discovery repeats on a schedule you set, so new assets and newly exposed services are picked up rather than assessed once and left stale.
Worked example
A forgotten staging host reappears in the weekly report.
Illustrative Atlas discovery report
Representative output, not a live customer instance
- staging-api.example-corp.internalReachable from the internet, TLS certificate expiredHigh
- vpn.example-corp.comOutdated VPN appliance version, known CVE affects this buildHigh
- mail.example-corp.comStandard mail service, current version, no exposure foundInformational
- beta.example-corp.comNew subdomain, not previously in asset inventoryReview
Each row links back to the discovery method and the validation step that confirmed it, so a reviewer can see how the finding was reached.
What you get
A ranked, validated report an operations team can work from.
- Asset inventory
- A maintained list of externally exposed domains, subdomains, IP ranges and services attributable to your organisation.
- Validated findings
- Exposures confirmed rather than raw scanner alerts, reducing time spent on false positives.
- Ranked report
- Findings ordered so the operations team knows what to address first.
- Recurring cadence
- Discovery reruns on a schedule you set, so the inventory reflects current exposure rather than a point-in-time snapshot.
What Atlas does
- External discovery and enumeration
- Exposure validation
- Ranked, recurring reporting
What Atlas does not do
- Autonomous exploitation of discovered exposures
- Acting on findings without a human decision
Where it deploys
Runs inside your environment, reporting outward.
Discovery scope you define
You set the domains and ranges Atlas is authorized to discover against, and the schedule on which discovery repeats.
Findings stay under your control
Reports, validated findings and the asset inventory are retained inside your environment rather than a shared external database.
Feeds into the rest of the platform
A validated finding can trigger a Nexus workflow, for example to open a ticket in your tracker or notify the owning team, using the same connector and trigger model as the rest of Nexus.
Architecture session
Find out what your organisation exposes today.
We will scope a discovery run against your domains and ranges and walk through a validated, ranked report.