Attack surface management from the attacker's view

Frequently asked questions

What is external attack surface management?

External attack surface management (EASM) is the continuous, automated discovery of every system of a company that is reachable from the internet: domains, subdomains, IP addresses, open services, web applications and the technologies in use. Unlike a one-off scan, EASM runs continuously and reports changes such as new hosts, new services or expiring certificates. blacklens.io adds vulnerabilities, dark web signals and lookalike domains to that view so the inventory becomes a prioritised task list.

How is the scope defined and expanded?

You enter domains, IP addresses, CIDR ranges or individual host-port combinations as scope. From there blacklens.io discovers subdomains, further IPs and services automatically. The platform also suggests extensions derived from your external attack surface, connected cloud accounts and RIPE and threat intelligence data. Exclusions are supported, and scope can be imported and exported. Scope also determines the licence price.

What does the exposure score mean?

The exposure score condenses the state of your attack surface into a number from 0 to 100. It takes into account exposed services, open findings by severity and the number of vulnerable assets, among other factors. Tiles show which assets are exposed, vulnerable or high-risk and filter any list with one click. blacklens.io stores a snapshot every night, so you can see the trend over week, month, quarter and year and present it to management or auditors.

Where does blacklens.io scan from, and how do I recognise the scans?

The scan infrastructure is located exclusively in Austria, Germany and Switzerland. Scans originate from fixed source IP ranges, which you can allow-list or label in your firewall and WAF. The platform itself runs in ISO 27001 and SOC 2 certified data centres in the DACH region.

How does blacklens.io handle lookalike domains?

For every monitored domain, spelling variants are computed daily across 357 top-level domains and checked against registration data (RDAP), DNS and reputation sources. Active domains are screenshotted and rated by a self-hosted AI model as impersonation, suspicious, parked, unrelated or inconclusive, with confidence and signals such as a password field, a cross-domain form or prompt injection. When a hit meets five evidence criteria, you get a pre-filled abuse report for the registrar or host. Lookalikes are removed after 60 inconspicuous days.

Does attack surface management also cover internal systems?

The external view is always included. For systems behind the firewall, Active Directory and IoT or OT devices, you add the Sentry agent, which runs as a virtual machine or Docker container inside your network. Cloud accounts at AWS, Azure, Microsoft 365, Google Cloud, Cloudflare and Hetzner connect via connectors. All sources land in the same inventory and the same workflow.

Which tools and data sources does discovery use?

Discovery in blacklens.io is a fixed chain of host, service, web, technology and lookalike detection. Thirteen specialised scanning engines work together, from port and service scans through DNS resolution to vulnerability checks, supported by a subdomain wordlist with 200,002 entries. Technologies are identified with 786 HTTP templates across 374 vendors plus 49 network protocol templates and decomposed into CPEs (application, hardware, operating system, service). This inventory is the basis for real-time CVE matching.

How does blacklens.io monitor TLS certificates?

TLS certificate monitoring tracks the certificates found on your external assets and shows each one as valid, expiring in a given number of days or expired. Forgotten certificates on secondary systems stand out before customers see a browser warning. Certificates sit in the same inventory as domains, services and technologies and, like every list, can be filtered and exported as CSV.