Attack Surface Monitor

Attack Surface Monitor discovers and tracks what your organisation exposes to the internet, from a server you control. It ships as a single Go binary with SQLite - no database server, no agents, no telemetry.

It enumerates hosts, ports and services, and flags the exposures that matter: a database reachable from the internet, an admin panel that should not be public, a service that was never meant to be internet-facing. Every finding arrives with the fix attached.

The part that earns its keep is change detection. Each scan is diffed against the previous one, so a port that opened after a Friday deploy shows up in Monday's list instead of in a penetration test report six months later. Findings deduplicate across scans and auto-resolve once the exposure is closed.

Active probing is gated behind proof of ownership: before it scans a domain, you must publish a DNS TXT record or an HTTP file containing a token it issues. The tool refuses to scan anything you have not demonstrably proven you control.

The free edition is Apache-2.0, covers one domain and runs the same engine as the paid tiers. Attack Surface Monitor is one of six self-hosted security tools built on a shared Go core.