Discover
Continuously enumerate every host, subdomain, port and service you expose. New assets land on the map within minutes of going live — there is no scan window to wait for.
SOC 2 Type II certified
Know every asset before an attacker does
Strata continuously discovers your external surface, attributes every host to an owner, and ranks exposures by how exploitable they actually are — not by raw CVSS. One live map, minutes not quarters.
Problem statement
The port you skipped is the one that sinks the audit.
1 in 3
breaches start at an asset the security team didn't know it owned — shadow IT, a forgotten staging box, an acquired subsidiary.
9 days
median time to notice a newly exposed service. An attacker scans the whole IPv4 space in under an hour.
18 tools
stitched together by the median enterprise to answer “what do we have facing the internet?” — and the answer is stale before it's assembled.
Your surface moves every time someone ships a container, registers a subdomain or closes an acquisition. A quarterly pen test is a photograph of a thing that has already changed — so we rebuilt discovery to run continuously, and to tell you who owns what it finds.
Learn moreLive surface map
Continuous visibility across everything you expose.
A pen test is a photograph; this is the live feed. Watch assets, open exposures and remediation time move together, filtered to any business unit, region or owning team.
Learn more SurfaceExposuresAttributionSettings
Close what matters, without waiting on the next scan window.
Always-on discovery
Runs continuously against your surface instead of on a scan schedule. New hosts appear within minutes of going live.
Owner-level attribution
Every host resolves to a team, with the evidence attached — so findings route themselves instead of sitting in a queue.
Passive by default
No agents, and no traffic to your hosts. Active fingerprinting is opt-in per range, rate-limited and logged.
Core capabilities
Three primitives. One live surface.
Discover, attribute and prioritise. Run them on their own or chain them end‑to‑end — the same API serves a single domain and an estate of forty thousand hosts.
Raw input
Typed output
Attribute
Resolve every host to a team, not a spreadsheet guess. WHOIS, DNS, cloud tags and certificate chains are correlated into one owner record — with a confidence score you can argue with.
1 surface · 4,182 assets
Prioritise
Rank by real‑world exploitability, not raw CVSS. Known‑exploited catalogues, reachability and asset criticality roll into one score, and each exposure leaves with an owner and an SLA.
Benchmark
Coverage that holds under load.
Share of a known 12,000-asset estate discovered within 24 hours — measured against incumbent ASM vendors, cloud-native inventories, network scanners and open-source tooling.
| System | Coverage (%) |
|---|---|
| Strata | 94.2 |
| ASM Vendor A | 88.6 |
| ASM Vendor B | 86.9 |
| Cloud-native A | 84.1 |
| ASM Vendor C | 82.7 |
| Network scanner A | 79.4 |
| Open source A | 76.8 |
| Cloud-native B | 74.2 |
| Open source B | 71.5 |
| Legacy VM A | 63.9 |
| Open source C | 61.3 |
| Legacy VM B | 54.7 |
Architecture deep dive
How the surface map is built.
Continuous enumeration
There is no scan window. Certificate transparency logs, passive DNS, registry deltas and cloud metadata are watched constantly, so a subdomain registered at 2am is on the map before the standup. Dangling CNAMEs are flagged the moment the target stops resolving, which is the window a subdomain takeover lives in.
The ownership graph
Discovery is the easy half; knowing who to wake up is the hard one. WHOIS records, DNS delegation, certificate subjects, cloud account tags and commit history are correlated into a single graph, so each host resolves to a team rather than a spreadsheet guess — with the evidence attached and a confidence score you can push back on.
Exploitability, not CVSS
A 9.8 on a host nobody can reach matters less than a 6.4 on your payment gateway. Scores combine the CVE, whether it sits in a known-exploited catalogue, whether the service is actually reachable from the internet, and how critical the asset is — so the queue is ordered by what an attacker would try first.
How it works
From one domain to a full surface map.
Seed it, watch it expand, close what it finds. The same three steps whether you own one domain or forty thousand hosts.
Seeds · 41 domains · 6 clouds
Give it a seed
A domain, an IP range, a cloud account. Strata expands outward from there — no agents to deploy and nothing installed on the hosts it finds.
Seeds · 41 domains · 6 clouds
Watch the surface fill in
Hosts, ports, services, certificates and CVEs enrich themselves. First findings land in minutes; the map never stops updating.
Request
POST /v1/discover
{
"seed": "acme.com",
"expand": ["subdomains", "cloud"],
"mode": "passive"
}Route and close
Every exposure leaves with an owner, a severity and an SLA clock, straight into the tracker your team already lives in.
| 443 · HTTPS | TLS 1.0 |
| 22 · SSH | OpenSSH 7.4 |
| 3306 · MySQL | exposed |
| Exposure score | 88 · critical |
FAQs
Frequently
asked
Anything of yours that answers from the public internet: hosts, subdomains, IP ranges, cloud buckets, load balancers, mail servers, certificates, and the services listening behind them. Assets you never registered count too — that’s usually where the interesting findings are.
A scanner checks the list you give it. Strata’s job is the list itself — finding the hosts nobody wrote down, then working out who owns them. The two are complementary: point your scanner at the inventory Strata builds and it stops testing a snapshot from last quarter.
By correlating WHOIS records, DNS delegation, certificate subjects, cloud account tags and repository metadata into a single ownership graph. Every attribution arrives with the evidence behind it and a confidence score, so a wrong call is something your team can see and correct rather than silently inherit.
Not unless you ask it to. The default mode is entirely passive — certificate transparency, passive DNS, public registries and cloud metadata — so nothing is installed and no traffic reaches your hosts. Active fingerprinting is opt-in per range, rate-limited, and logged so you can hand the record to whoever asks.
Per asset under management, with the rate falling as the estate grows, and no separate charge for discovery — you’re never billed for finding something you didn’t know you had. Self-hosted deployments are licensed annually.
See your own attack surface.
Give us a domain and we'll map what it exposes before the call, then walk the findings with you — including the ones nobody expected.
It surfaced a staging box on port 8080 that had been live for two years and appeared in no inventory we had. What used to be an hour per asset review is now minutes, and the ownership routing means it lands on the right team without me chasing it.