Find the doors you forgot were open.
Forgotten subdomains, takeover-prone records, risky ports answering from the internet, and the leaked passwords attackers try first — seen from the outside, with your consent where it matters.
Forgotten subdomains and dangling DNS records are a common entry point for attackers. Continuous monitoring helps you find and secure subdomains you did not know were exposed.
What you can monitor
Discover forgotten hosts, open ports, exposed devices and leaked passwords.
Subdomain discovery
Enumerate subdomains across your estate, including forgotten and shadow infrastructure.
Takeover detection
Identify dangling DNS records that could allow subdomain takeover.
Exposure mapping
Find subdomains exposing services or ports that should not be public.
Change tracking
Monitor new subdomains as they appear and flag unexpected additions.
Exposure scan
With your consent, a plain connection to a fixed list of risky ports (remote desktop, databases, file sharing, self-hosted AI services, and building and industrial control ports such as Modbus, Niagara, Siemens S7, EtherNet/IP, DNP3 and MQTT) on hosts under your verified domains and on addresses you add and we verify. Weekly and 34 ports on Pro; daily and 67 ports on Growth and above. Device pages and outdated web servers are recognised on both. No login attempt, no exploit, no CVE matching.
Leaked-password audit
A script on your Windows domain controller compares password fingerprints with a public list of leaked ones. Only counts reach us: how many accounts, and how many of them administrators. Pro and above.
Devices on bare addresses
A refrigeration or building controller, a camera or a 4G router often answers on a provider address with no name under your domain, which is how the October 2026 attack on supermarket refrigeration got in. Add the address; once we have proved it is yours, it is scanned too. From Pro up the device is recognised from the page title and server name it volunteers, for example “Danfoss AK-SM 800 series web interface reachable from the internet”, with one plain page request and no login; for older Danfoss models (AK-SM 800 before the “A” range, AK-SC 255 / 355) it also says when the maker ended them. Reachable is the finding: we say what answers and never claim a weakness.
Safe active tests
Safe active tests, not cached port data
Free tools tell you which ports someone else saw open last month. SkyQon connects to your own verified hosts and asks them directly: a handshake, one page request, no login and no payload.
Old encryption
Every certificate scan also tries TLS 1.0, TLS 1.1 and an offer of only 3DES and RC4. If the server accepts any of them, the certificate row says what it accepted, and each such endpoint costs one point in your Digital Trust Score, at most five in all.
Outdated web servers
When a web server names itself, we compare the name with its maker’s support calendar: Microsoft IIS 8.5 and older, Apache httpd 2.2 and older, PHP 7.x and older. The finding gives the date support ended and the source.
Exposed AI services
Ollama, Qdrant and Milvus answer without a login out of the box. The exposure scan looks for them, and for Gradio, Ray and Open WebUI on the deep scan.
PHP older than its security release
PHP shipped security releases on 22 October 2026 for the flaw reported as PHP2Shell. When a server shows its PHP version, we compare it with those releases. Older servers go to the top of the list with the steps in order: upgrading is the only fix, and a VPN, an allow-list or a firewall rule only narrows who can reach the server until then. A finding closes when a fixed version is seen, not when the version is hidden.
Versions a server hides
Many servers hide their version number. On Pro and above, the SkyQon agent can read the PHP, Apache and nginx versions from inside the server, containers included, once you switch the option on. When Debian, Ubuntu or Red Hat shipped the fix under the old version number, the row says “Fixed by Debian” (or Ubuntu, or Red Hat) instead of raising an alarm.
In your NIS2 report
The NIS2 evidence report lists each server that ran software older than a security release during the period, and the day it was fixed. The board report carries the count.
One step to the fix
An expiring or untrusted certificate, on the certificate list or on an exposure row, links straight into Auto-Renew, which issues and installs the replacement on your server and proves it on the next scan.
Old-TLS checks run on every plan with certificate monitoring. The exposure scan needs a verified domain and an administrator’s consent: light scan (34 ports, weekly, with web-server and device checks) on Pro, deep scan (67 ports, daily) on Growth and above.
What every scan checks
The configuration behind each address
Four areas, checked on every domain, mail server and HTTPS address you monitor.
DNS and DNSSEC
Check DNSSEC signing and nameserver health across your domains, and spot dangling DNS that could let someone take over a subdomain. Validate DANE (TLSA) records against the certificate each server presents.
SSL and TLS protocols
See every protocol version from SSL 2.0 to TLS 1.3, the cipher suites and key-exchange groups each address accepts, and which common browsers and systems would connect. The full detail runs weekly on Pro and above.
Application security
Check HSTS, Content-Security-Policy, framing protection, cookie flags, subresource integrity and mixed content on the home page of every HTTPS address.
SMTP security
Check that each mail server offers STARTTLS and that its DANE record matches its certificate. See whether SPF, DKIM, DMARC and MTA-STS are published and enforced.
Secure subdomains you forgot existed.
Continuous monitoring helps you discover and close subdomain exposure before attackers find it.