The short version. Detection only. It maps reachable TCP services, identifies the product and version behind them, flags anything serving data without authentication, and maps known CVEs to what it fingerprinted. It does not exploit, does not reuse credentials and does not extract data.
What this engine does
Most breaches of this shape do not start with a clever exploit. They start with something being reachable that nobody meant to expose. That is what this engine looks for.
- TCP port and service discovery across the hosts, addresses or ranges you authorise.
- Product fingerprinting — what is really answering on that port, and which version.
- No-authentication exposure — open Redis, Elasticsearch, MongoDB, Docker API, anonymous FTP, SMTP open relay. Detected by connecting and reading the banner, never by taking data.
- Version-to-CVE mapping — known vulnerabilities matched to what was fingerprinted, presented as detection rather than as a proven exploit.
- Transport posture on TLS-speaking services — handshake only.
What it deliberately does not do
The boundary is deliberate. An external network sweep that exploits is how a security exercise turns into an incident:
- No exploitation. Nothing found here is attacked to prove it. Exposure is evidenced by the connection itself.
- No credential attempts. No default passwords are submitted, no credentials reused, no brute force.
- No data extraction. An open database is reported as open; its contents are not read or dumped.
- No raw-socket trickery. No OS fingerprinting by fragmentation, no decoys, no UDP flooding — TCP connect scanning only.
- No internal networks. Public-routable targets only; the runner has no route to RFC1918 space at all.
How we prove you are allowed to run it
Authorisation is a hard gate, not a checkbox in our terms. A scan starts only if the asset is verified by Domain Control Verification — you place a DNS TXT record or a file we specify — or you supply an explicit legal-authority attestation stating you own the target or are authorised to test it. A request carrying neither is refused with HTTP 403, at every tier, with no override. Because a network range can span hosts you do not own, this engine is where the attestation matters most: you are stating, on the record, that the addresses you listed are yours or that you are authorised to assess them.
Where your data goes, and when it is deleted
Everything runs on EU infrastructure: edge functions in EU regions, scan compute in Frankfurt, object storage under EU jurisdiction, model inference through an EU endpoint. Nothing is used to train any model — ours or a third party's — and that is a contractual term in the DPA, which every plan gets.
- The report — kept two years, so you can hand it to an auditor next year.
- Raw uploaded material — third-party scanner files 30 days, application binaries 60 days, then deleted automatically.
- The anonymous homepage preview — content erased after 24 hours.
- The authorisation record — kept, because it is the evidence that the scan was permitted.
The full schedule is in our Privacy Policy, and the sub-processor list is on the Trust Center.
How a run actually works
The scan runs from an EU machine in its own sandboxed workspace, with a fixed egress address. Discovery, identification and exposure checks are deterministic Node code rather than model decisions; the agents interpret and prioritise the result, they do not decide what to probe.
One consequence worth knowing in advance: a single fixed source address means an aggressive rate limit or IP-based blocking on your side can shorten the assessment. The report tells you when that happened instead of quietly returning a clean-looking result.
What you get at the end
An inventory of what is reachable, what is answering, what is answering without authentication, and which known CVEs match the versions identified — each with the evidence that established it. Findings are ranked by exposure rather than by raw CVSS, because an unauthenticated database on the internet outranks a theoretical high-severity issue behind three controls.
What this engine cannot find
Detection-only means a specific set of blind spots, and they are worth stating plainly:
- A CVE matched to a fingerprinted version is a strong signal, not proof — your build may already carry a backported fix.
- Services that require credentials to reveal anything are recorded as present, not assessed.
- Anything not reachable from the public internet is out of scope by construction.
- A firewall that drops rather than rejects can make a live host look absent.
- Application-layer flaws on a web port belong to the Web engine; this one stops at the service boundary.
We publish this list for the same reason we publish our own assessment report, limitations section included: a vendor that cannot tell you what its tool misses is asking you to take the rest on faith.
Frequently Asked Questions
Is this a penetration test?
Not in the exploitation sense, and we do not describe it as one. It is an external exposure assessment: it establishes what is reachable and what answers without authentication, then stops. If you need flaws proven by exploitation, that is the Web or API engine.
Will it trip our IDS or get our scanner IP blocked?
It may. Traffic comes from a single fixed egress address and looks like what it is — a TCP connect scan. Many teams allowlist it for the duration of the assessment; if you do not, the report tells you where blocking cut coverage short.
Can it scan our internal network?
No. The runner has no route into private address space, by design. Internal assessment needs an agent inside your network, which we do not offer today.
Do you try default credentials on what you find?
No. Submitting default credentials is an authentication attempt against a system whose ownership we can only take on trust, so it is a hard exclusion — even where it would produce a more dramatic finding.
What do you keep afterwards?
The report for two years, the authorisation record as evidence the scan was permitted, and nothing else. Processing stays within the EU and nothing feeds model training.