External attack surface management (EASM)
See your perimeter the way attackers do.
Nulink Exposure Management is agentless external attack surface management. You verify a root domain with a DNS TXT record; Nulink maps everything reachable from the outside and keeps rescanning it. Subdomains, hosts, certificates, open ports, the software behind them, the DNS and email records in front of them, and the lookalike domains and leaked credentials trading on your name. Nothing to install, no credentials to hand over, and only verified domains are ever scanned.
From one verified domain to a full external inventory.
- 01
Verify
Add a root domain and publish the TXT record Nulink gives you. That record is your proof of ownership, and it is the only thing that puts a domain in scope.
- 02
Discover
Certificate transparency logs, passive DNS, brute-force resolution, web crawling, archive mining and passive OSINT expand the seed into every host, site and address connected to it.
- 03
Analyse
Each asset is port-scanned and fingerprinted, then checked: TLS, security headers, cookies, CORS, DNS and email records, and detected software versions against the National Vulnerability Database.
- 04
Prioritise
Every finding arrives with the evidence that proves it, a severity and remediation guidance, ranked so the short list at the top is the one worth your morning.
- 05
Rescan
Scans repeat on your plan's schedule, or on demand for a whole domain or a single module. Findings close themselves once a rescan shows the problem fixed.
Nine modules, one list of findings.
Compare plans
Asset discovery
ASMStart from one verified domain and map every internet-facing host, address and service tied to it.
Read more
Subdomains and lookalikes
DNSCatch forgotten subdomains, dangling DNS records and the domains registered to impersonate you.
Read more
Shadow IT discovery
Shadow ITSurface the servers, sites and services someone launched without telling security.
Read more
Certificates and TLS
TLSWatch every certificate issued in your name, and check what your servers actually negotiate.
Read more
Ports, services and CVEs
ServicesSee which ports answer on your hosts, what runs behind them, and which versions have known CVEs.
Read more
Web exposure checks
WebCheck the headers, cookies, CORS policies and technology stack in front of every site you run.
Read more
DNS and email security
EmailCheck SPF, DMARC, DKIM and MX on every domain, including the ones you forgot you own.
Read more
Credential and secret exposure
LeaksFind staff credentials in breach data and API keys left behind in archived pages.
Read more
Continuous monitoring
MonitoringRescan on a schedule or on demand, diff every run, and let fixed findings close themselves.
Read more
Everything Nulink checks.
No module is an upsell to a different product. This is the list, grouped by what it is for.
Discovery
Everything reachable from your verified domains, found the way someone targeting you would find it.
- Subdomain discovery from certificate transparency logs, passive DNS sources and brute-force resolution
- Certificate transparency monitoring: every certificate issued for your domains, as it is logged
- Web crawling of discovered sites to find further hosts, pages and endpoints
- Web archive mining for historical URLs and pages that were deleted but never forgotten
- Shadow IT discovery through passive OSINT: hosts, sites and staff email addresses nobody registered with security
- WHOIS and RDAP registration records on every domain
- GeoIP location for every address, plotted on a map
Exposure analysis
What each host actually runs, and which part of it is a problem.
- Port scanning of the top 1,000 TCP ports per host, with service and version detection
- Passive internet service intelligence, cross-checked against our own scan results
- Detected software versions matched against CVEs in the US National Vulnerability Database, with severity and advisory links
- TLS inspection: expiring, expired and weak certificates, outdated protocol versions and weak cipher suites
- Security header, cookie flag and CORS policy checks on every web host
- Web technology fingerprinting: the stack behind each site
- SPF, DMARC, DKIM and MX checks on every domain
- Dangling DNS records pointing at decommissioned services, which is where subdomain takeover starts
Brand and identity
The exposure that never touches your infrastructure at all.
- Lookalike domain detection: typosquats, homoglyphs and impersonation domains
- Whether each lookalike has MX records, and can therefore send mail that appears to come from you
- Where each lookalike is registered and hosted
- Breached credential discovery: staff addresses and passwords appearing in breach data
- Leaked secrets: API keys and tokens left behind in archived page content
Working with findings
What happens after something is found, which is where most tools stop being useful.
- Every finding carries its evidence: the record, response or source that proves it
- Severity ranking and remediation guidance on each finding
- Lifecycle status your team controls: open, reviewed, resolved
- Automatic closure once a rescan shows the problem fixed
- Scheduled rescans set by plan, plus manual rescans of a whole domain or a single module
- A relationship graph linking every asset to the findings and the assets around it
Why an outside-in view matters.
- Verified domains only
- Nothing is scanned until a TXT record in the domain's own zone proves you control it. Remove the record and the domain leaves scope. No surprise scanning, and nothing for your legal team to unpick.
- Agentless, and outside only
- No agents, no appliances, no VPN, no cloud credentials. Exposure Management sees exactly what the internet sees, which is exactly what an attacker starts with.
- Evidence, not assertions
- Every finding carries the record, response or source that proves it, so your team can verify it themselves before they act on it.
- Continuous, not annual
- A penetration test is a photograph. Scans repeat on a schedule, each one is diffed against the last, and findings close themselves when a rescan shows the fix landed.
Works from
- Certificate transparency logs
- Passive DNS
- WHOIS / RDAP
- OSINT sources
- NVD (NIST)
- Web archives
- theHarvester OSINT
- Breach datasets
- GeoIP
How it scans.
Worth reading before you buy, and worth forwarding to whoever signs off on scanning.
- Only what you have verified
- A domain enters scope when the TXT record Nulink issues appears in its zone, and leaves scope when you remove it. Discovery works outward from there and nowhere else.
- Read-only and unauthenticated
- Nulink connects to your services the way any visitor does. It does not log in, does not submit forms and never holds credentials of yours.
- No exploitation
- Vulnerability findings come from matching detected versions and configurations against public advisories. Nulink reports what it sees rather than proving it by breaking something.
- Nothing inside your network
- No agents, no appliances, no cloud connectors. If an asset is not reachable from the public internet, Exposure Management cannot see it, by design. That inside view is what Nulink Cloud is for.
What Exposure Management does not do
- Log into your applications or test anything behind authentication
- Submit forms, fuzz inputs or attempt to exploit what it finds
- Scan domains you have not verified, or assets with no relationship to them
- Scan every port: coverage is the top 1,000 TCP ports per host, so a service parked on an unusual high port can be missed
- Replace a penetration test, which is where business logic flaws and chained attacks get found
- See anything that is not reachable from the public internet
Questions buyers ask us.
What do we have to give you to start?
A root domain, and a TXT record published in its DNS. There is nothing to install, no account to connect and no credentials to hand over. Discovery begins as soon as the record resolves.
How do you know the domain is really ours?
Because only someone who controls the DNS can publish the verification record Nulink issues for it. That is the whole gate: verified domains are scanned, unverified domains are not, and removing the record takes a domain back out of scope.
Will scanning break anything?
Most of what Nulink does is passive. Reading certificate transparency logs, passive DNS, WHOIS, web archives and our suite of OSINT tools touches nothing of yours. The active part is a port scan of the top 1,000 TCP ports and ordinary requests to the web hosts it finds. There is no exploitation, no fuzzing and no authenticated testing. It is still worth telling your SOC the scans are coming, because a competent one will notice.
Is this a penetration test?
No, and it is not sold as one. A penetration test is a person chaining flaws together on a defined scope for a week. Exposure Management is continuous coverage of what you have exposed, which is the input a good penetration test should start from. Teams that run both usually find the test gets more interesting, because the obvious findings are already closed.
How often does it rescan?
On a schedule set by your plan, and on demand whenever you want: a whole domain, or a single module after a change you want verified.
How do you deal with false positives?
By showing our working. Every finding carries the record, response or source it came from, so your team can judge it in seconds instead of reproducing it by hand. Anything you look at and decide to accept gets marked reviewed, and stops crowding the findings you have not seen yet.
Where do breached credentials come from?
From breach corpora already in public circulation, searched against the domains you have verified and nothing else. The exposure exists whether or not you are looking at it; Nulink's job is to make sure you are the one who finds it first.
Can we use it without Nulink Cloud?
Yes. Exposure Management stands on its own and needs no cloud connectors. Pair it with Nulink Cloud when you want the inside view of what you run as well as the outside view of what you expose.
Also from Nulink
Nulink Cloud
Nulink Cloud is an agentless CNAPP for AWS, Azure and Google Cloud. It checks your cloud configuration, infrastructure code, application code and dependencies, maps every finding to the frameworks you're audited against, and tells you what to fix first.
Explore Nulink Cloud
Visibility is security. Start with yours.
Book a 30-minute walkthrough with the team, or connect your first account and see results today.