External attack surface management
Prism continuously discovers your external surface, attributes every host to an owner, and ranks exposures by real-world exploitability — packaged into a shareable report in minutes, not quarters.
$ prism scan --org northwind --depth fullresolving seed domains .............. 41 foundenumerating subdomains ............. 1,284 hostsprobing certificate transparency ... 3,907 recordsfingerprinting services ............ 6,412 ports openattributing ownership .............. 6 clouds · 22 teamscorrelating CVEs ................... 214 matchedscoring exploitability ............. done in 3m 12s SEVERITY ASSET FINDINGCRITICAL api-staging.northwind.io:8080 unauth admin panelCRITICAL vpn-legacy.northwind.io:443 CVE-2023-46805 · exploitedHIGH mail-gw.northwind.io:443 CVE-2024-21762HIGH s3-backups.northwind.io public bucket listingMEDIUM cdn-edge.northwind.io:80 dangling CNAMEMEDIUM git.northwind.io:22 weak host keyLOW docs.northwind.io:443 deprecated TLS suite unattributed hosts ................. 97 → routed to #sec-triage✓ 4,182 assets mapped · 37 exposures · report readyGetting started
Install once, point Prism at a domain, and it does the rest — discovery, ownership attribution and exploitability scoring, all from a read-only vantage point outside your network.
Prism works entirely from outside your perimeter — the same vantage point an attacker has. Setup is a shell command and a domain.
Install the CLI
curl -fsSL https://prism.sh | sh Point it at your org
prism init --org acme --seed acme.com Run your first scan
prism scan --depth full Seed a domain or an IP range and Prism keeps enumerating — subdomains, certificates, cloud tenancy, forgotten staging boxes. The inventory is never a snapshot.
Re-scanned every 4 hours
Every host resolves to a registrant, a hosting provider and an internal team. Findings route themselves, so nobody spends a morning working out whose box it is.
22 teams mapped automatically
CVSS tells you what could go wrong in theory. Prism ranks by what is reachable, unauthenticated and actually exercisable from the open internet.
Reachability-weighted, not CVSS-only
Trusted at scale
Built for breadth
Discovery is incremental, so a 40-host startup and a 400,000-host conglomerate get the same first result in minutes. Nothing queues behind a nightly full sweep, and adding a subsidiary doesn't reset your baseline.
Scans are rate-shaped to stay well inside acceptable-use policy on every provider we touch — you will not get a call from your host about us.
Less glue
Prism replaces the spreadsheet, the scanner export, the DNS side-quest and the Slack thread where someone asks whose box this is. One view, continuously updated, with the evidence attached to the finding.
Everything the UI does is available from the CLI and the API, so the workflow survives contact with your existing automation.
Assurance
The Prism console
Five steps from first packet to closed ticket — all against one continuously updated picture of what you actually expose.
Step 01
Seed one domain. Prism walks certificate transparency, passive DNS, cloud tenancy and registrar records until the picture stops changing — then keeps walking it every four hours.
Step 02
A critical CVSS behind three firewalls matters less than an unauthenticated admin panel on the open internet. Prism scores reachability first and severity second.
Step 03
Registrant, hosting provider, cloud account and owning team — resolved automatically, so a finding arrives with a name attached instead of starting a hunt.
Step 04
Comment, assign and close without leaving the exposure. Every change syncs live, so the response is designed once rather than reconstructed from a Slack thread later.
Step 05
One link gives a stakeholder the whole picture — inventory, exposures, remediation plan and SLA status — without anyone exporting a slide.
Coverage
Prism doesn't care where a host lives. If it answers from the public internet, it's in scope — and if it stops answering, Prism notices that too.
AWS, Azure, GCP, Cloudflare, Fastly, bare metal in a cage somewhere — all normalised into a single asset list with consistent ownership and scoring.
18 providers fingerprinted
There is no agent, no collector VM and no credential to rotate. Prism sees what an attacker sees, from where an attacker stands.
Field note
A client of ours did everything right. They scoped the engagement, inventoried the CMDB, ran every scanner and signed off the report. Every box ticked.
Then came the audit. A host nobody had listed was still answering on 8080 — a staging box stood up for a two-week test three years earlier and never torn down.
That's why continuous discovery is the default in Prism, not a paid tier. One more stone turned over, before someone else turns it.
| Exposure score | Business impact | Unmapped assets |
|---|---|---|
| 8.0–8.3 | 7.0–7.3 | 33 |
| 8.3–8.5 | 7.3–7.7 | 33 |
| 8.5–8.8 | 7.7–8.0 | 28 |
| 8.8–9.0 | 7.0–7.3 | 27 |
| 8.5–8.8 | 7.3–7.7 | 27 |
| 8.3–8.5 | 7.7–8.0 | 27 |
| 8.3–8.5 | 7.0–7.3 | 26 |
| 8.0–8.3 | 7.3–7.7 | 26 |
| 7.8–8.0 | 7.0–7.3 | 25 |
| 8.8–9.0 | 7.3–7.7 | 25 |
Start mapping
Map your external attack surface in minutes. Free for the first 500 assets, no card, no call.
