Platform

External Penetration Testing &
Attack Surface Management

Your internet-facing infrastructure is your first line of defense, and the first thing attackers probe. Canima combines deep penetration testing of external assets with continuous attack surface monitoring, delivering both point-in-time assessments and 24/7 surveillance from hundreds of specialized AI agents.

Request Demo → View Pricing

canima-agent

$ canima agent deploy --scope external
[*] Target: *.example.com
[*] Subdomain enum: 142 discovered
[+] Open port: 443/tcp → nginx/1.18.0
[+] CVE-2021-23017 confirmed (Nuclei + Nessus)
[*] Credential spray: vpn.example.com
[+] Valid: [email protected] (weak pwd)
[!] ASM alert: new subdomain staging.example.com
[!] Dark web: 23 credentials in stealer logs

01 / EXTERNAL ASSESSMENT

Full External Attack Surface Covered and Monitored

From initial reconnaissance through controlled exploitation, then continuous monitoring that never sleeps. Every internet-facing asset is discovered, tested, and tracked.

Reconnaissance & Asset Discovery

Automated discovery of all internet-facing assets including domains, subdomains via certificate transparency and DNS brute-forcing, IP ranges, open ports, and running services. OSINT gathering includes email harvesting, GitHub secret scanning, Google dorking, and public data exposure. Every discovered asset becomes a node in the knowledge graph.

Subdomain Enum Cert Transparency OSINT Google Dorking

Multi-Engine Vulnerability Assessment

Cross-validates findings across industry-leading scanners (Nuclei, OpenVAS, Nessus) to minimize false positives. Deep service enumeration across SMB, SNMP, LDAP, RPC, HTTP/S, DNS, FTP, SSH, RDP, VPN/IPsec, and more. Version-level CVE mapping with exploit availability tracking so you know which vulnerabilities are weaponized, not just theoretical.

Nuclei Nessus OpenVAS CVE Mapping

Controlled Exploit Validation

Confirmed vulnerabilities are validated through controlled exploitation, not just flagged as "potentially vulnerable." Credential testing against discovered services covers default credentials, weak passwords, and password spraying. VPN and IPsec endpoint security is assessed for cryptographic weaknesses and configuration flaws.

Metasploit Hydra Credential Testing VPN Assessment

Continuous Attack Surface Monitoring

ASM runs 24/7 with configurable cron schedules per monitor type. Detects newly opened ports, DNS changes, subdomain takeover opportunities, new CVEs affecting your deployed versions, and unauthorized record modifications. First-seen and last-seen timestamps track asset lifecycle with active, inactive, new, and changed status tracking.

Port Monitoring DNS Changes CVE Tracking Subdomain Takeover

Dark Web & Breach Intelligence

Breach monitoring agents scan stealer log dumps, dark web marketplaces, credential databases, and paste sites for your organization's exposed data. Results include source classification (stealer, dark web, credential dump), affected email addresses, password exposure flags, and employee vs. consumer classification to prioritize response.

Stealer Logs Credential Dumps Dark Web Breach Triage

Phishing & Brand Protection

Phishing detection agents monitor for lookalike domain registrations and active phishing infrastructure targeting your brand. Google dork monitoring detects sensitive files, admin panels, and configuration data exposed via search engine indexing. Real-time alerting with severity classification ensures you see threats before your users do.

Lookalike Domains Phishing Detection Dork Monitoring Brand Protection

Continuous Monitoring

24/7

Specialized AI Agents

100s

Cross-Validated Findings

Multi-Engine

Threat Alerting

Real-time

02 / ASSESSMENT PIPELINE

How External Testing & ASM Works

A two-phase approach: deep penetration testing to find and validate vulnerabilities now, then continuous monitoring to catch what changes tomorrow. Both phases feed into the same knowledge graph.

Discovery & Reconnaissance

Recon agents enumerate your full external footprint: domains, subdomains, DNS records, IP ranges, open ports, and running services. OSINT agents harvest emails, scan GitHub for leaked secrets, and run Google dork queries. Every asset is indexed in the knowledge graph with relationship edges connecting domains to IPs to services.

Enumeration & Vulnerability Assessment

Service-specific agents perform deep enumeration across every discovered protocol. Multiple vulnerability scanning engines run in parallel and cross-validate findings to eliminate false positives. CVEs are mapped to exact versions with exploit availability and CVSS scoring. Results flow into the graph where agents can correlate a vulnerable service back to its domain, IP, and network context.

Exploitation & Validation

Exploit agents read confirmed vulnerabilities from the graph and perform controlled exploitation to validate real-world exploitability. Credential testing agents spray discovered services with default and weak passwords. Each validated finding gets proof-of-concept evidence and reproduction steps. The graph distinguishes between theoretical and confirmed-exploitable vulnerabilities.

Continuous ASM Monitoring

After the initial assessment, ASM agents run on configurable schedules: port monitors, DNS monitors, CVE monitors, breach monitors, phishing monitors, and dork monitors. Each check compares against baseline state in the graph. New assets, changed configurations, fresh CVEs, and detected breaches trigger real-time alerts with severity classification.

03 / PROJECT KNOWLEDGE GRAPH

Correlated Intelligence Across Your Entire Attack Surface

Every discovered asset, service, vulnerability, and breach record is a node in a live graph database. Agents write Cypher queries to create and traverse relationships, connecting a subdomain to its IP, to the service it runs, to the CVE that affects it, to the exploit that validates it. This is infrastructure intelligence, not a flat scan report.

cypher query

MATCH (scanner:ReconAgent)
  -[:DISCOVERED]->(host:Host)
  -[:EXPOSES]->(svc:Service)
MATCH (vuln_agent:NucleiAgent)
  -[:IDENTIFIED]->(cve:CVE)
  -[:AFFECTS]->(svc)
WHERE cve.cvss >= 7.0
RETURN host, svc, cve,
  cve.exploitAvailable AS weaponized

Full Asset Relationship Mapping

Domains resolve to IPs, IPs expose services, services have versions, versions match CVEs. The graph captures every relationship so you can trace any vulnerability back to the business asset it impacts.

Cross-Engine Deduplication

When multiple scanners flag the same service, the graph merges findings by matching host, port, and CVE. You get one validated finding, not three duplicates with conflicting severity scores.

Baseline Drift Detection

ASM agents compare current state against the graph baseline on every run. New nodes or changed edges trigger alerts: a new open port, a DNS record change, a subdomain that did not exist yesterday.

04 / WHY CANIMA

Beyond Scanning: Intelligent Offensive Security

Traditional external assessments run a scanner and hand you a PDF. Canima deploys hundreds of specialized agents that coordinate through a shared knowledge graph, cross-validate findings across engines, and then keep watching your attack surface 24/7.

Pentest + ASM in One Platform

Deep penetration testing and continuous attack surface management are not separate products. They share the same knowledge graph, the same agent infrastructure, and the same dashboard. Your initial assessment becomes the baseline for ongoing monitoring.

Multi-Engine Cross-Validation

Canima does not rely on a single scanning engine. Multiple industry-leading tools run in parallel, and findings are cross-validated through the knowledge graph. A vulnerability flagged by one engine and confirmed by another has a fundamentally different confidence level than a single-source finding.

Controlled Exploitation, Not Just Detection

Flagging a CVE as "potentially vulnerable" is not enough. Canima's exploit agents validate confirmed vulnerabilities with controlled payloads and document proof-of-concept evidence. You know what is actually exploitable, not what might be.

Capability comparison: Canima versus other tools
Capability	Canima	Others
Multi-engine cross-validated scanning	Yes	No
Controlled exploit validation with PoC	Yes	No
Live knowledge graph correlation	Yes	No
Integrated ASM with pentest baseline	Yes	No
Dark web & breach monitoring	Yes	No
Phishing & lookalike domain detection	Yes	No
Configurable monitor schedules	Yes	No
Agent activity logs with proof	Yes	No

05 / GET STARTED

Ready to see your external attack surface?

Start your free 7-day demo to see how Canima discovers every internet-facing asset, validates real vulnerabilities, and monitors your attack surface around the clock.

7-day access to demo environment
See a live external assessment walkthrough
Explore the ASM monitoring dashboard
No commitment required

Get a demo → Contact us