Attack surface monitoring (launching soon)

Launching soon. Attack surface management (ASM) is not generally available yet. It is switched on per deployment, and the screens below appear only where it is enabled.

ASM watches the domains and IP ranges you authorize, shows what is exposed, and flags what changed. It supports your penetration tests rather than replacing them: when something needs real testing, it feeds into an engagement.

How it works

• Passive observation always runs on authorized roots. It uses public sources such as certificate transparency logs and public DNS, and never contacts your systems.
• Active assessment contacts your services directly. It stays off until a Client Administrator gives explicit authorization. That authorization is given once, not per scan.
• Human validation. Discovery produces signals, not findings. A TrekShield analyst reviews a signal before it is reported to you as a confirmed finding.

What you see

An Attack Surface group appears in the sidebar:

Screen	Shows
Overview	Monitoring health, open critical and high exposures, retests due, changes in the last 7 days, assets monitored, and what needs your attention
Assets	Monitored assets, ownership status and when each was last observed
Exposures	Confirmed findings, signals Under review (labelled UNVERIFIED), and attack paths
Monitoring	Monitoring status, passive and active coverage, scope revision, domains and change feed

Monitoring health is Active, Degraded (the last assessment is overdue or incomplete), Awaiting authorization, or Paused. An asset not seen for over 7 days is marked stale. Treat UNVERIFIED items as leads, not confirmed risk: they can be reclassified or dropped.

All customer roles can read these screens. Only Client Administrators can authorize active assessment, and only they can request changes.

Add a domain

You cannot add monitoring roots directly. A Client Administrator opens Monitoring, selects Add domain / Verify ownership, and submits the domain with proof of ownership. Your TrekShield account team approves it before monitoring starts.

Fixing and reporting

Confirmed exposures follow the same path as pentest findings: assign a remediation, then request a retest. Download an attack surface report from the Overview page; it opens in Reports.

Attack surface events can also be sent by webhooks.