xSpctr homexSpctr

Resources

Attack surface management, in plain words.

Short guides, the terms you will meet and answers to the questions we hear most.

Guides

Start here.

Guide · 5 min readAttack surface managementWhat ASM is, how it works and where to start.Read the guide Guide · 6 min readSPF, DKIM and DMARCStop others sending mail in your name.Read the guide Guide · 7 min readThe ten NIS2 measuresArticle 21, measure by measure.Read the guide

Glossary

The terms, without jargon.

ASM
Attack surface management: continuously finding and assessing everything you expose.
EASM
External attack surface management: the same, seen only from the internet.
CVE
Common Vulnerabilities and Exposures: the public catalogue of known vulnerabilities.
CVSS
Common Vulnerability Scoring System: how severe a vulnerability is, from 0 to 10.
KEV
Known Exploited Vulnerabilities: CVEs that attackers are known to use in the wild.
EPSS
Exploit Prediction Scoring System: how likely a CVE is to be exploited in the next 30 days.
Certificate transparency
Public logs of every TLS certificate issued, a rich source of your hostnames.
Shadow IT
Systems and services run without the knowledge of the IT team.
SPF
A DNS record listing the servers that may send mail for your domain.
DMARC
A DNS record telling receivers what to do with mail that fails SPF and DKIM.
DNSSEC
Signatures on DNS answers, so they cannot be forged on the way.
NIS2
The EU directive on cybersecurity for essential and important entities.

Questions

Frequently asked

Do I need to install anything?

No. Discovery and external checks start from your domain name, with nothing to install. For internal networks there is an optional appliance that only connects outbound.

Is the scanning safe for my systems?

Discovery uses public sources. Active checks are light, rate-limited and run only on assets whose ownership you have verified. See the legal notice.

What does "possible CVE" mean?

xSpctr matches the software versions it observes against known vulnerabilities. Many distributions patch without changing the version number, so a match is labelled possible until someone confirms it.

Who sees our data?

Only your organisation. Each organisation sees only its own scope, findings and reports.

How do I get access?

xSpctr is in closed beta. Get access and tell us about your organisation; we onboard new teams in small groups.

Find out what you expose. Start with one domain.

Tell us about your organisation and we will set you up.

Get access
Take the tour