Domain and subdomain map
Every root domain, subdomain, and DNS record we can find from public sources, matched to an owner.
The Problem
You Can't Protect Servers Nobody Remembers Owning
It builds up over years of campaign microsites, agency builds, acquisitions, and cloud experiments, until the list IT keeps no longer matches what the internet can reach.
01 · Shadow sites
Old microsites and staging copies still run, unpatched.
Weekly discovery finds them, and we confirm the owner before anything is shut down.
02 · Dangling DNS
Subdomains point at deleted cloud resources anyone could claim.
Stale records are listed with their fix and removed on the larger plans.
03 · Open ports
Test servers expose SSH or databases to the whole internet.
Each exposed service is checked by hand and ranked by risk.
04 · Drift
A one-time audit goes out of date within weeks.
The map is rebuilt every week and changes are flagged within 48 hours.
Your IT list names the main website, the customer portal, and the VPN. Certificate logs tell a different story: an old campaign microsite on unpatched WordPress and a staging copy of the portal. One subdomain still points at a cloud bucket someone deleted. Whoever claims that bucket can serve pages on your domain. A contractor's test server still answers on the SSH port. None of it shows up in your scans, because nobody knew to scan it.
We start from the outside, the way an attacker does: DNS, certificate logs, cloud IP ranges, and public code. Everything we find is matched against your own asset list, and an engineer confirms who owns each unknown and what it exposes. The risky items get closed, and the map is rebuilt every week. New exposures reach you as a short, checked alert, not a dashboard full of guesses.
Found from the outside
We map domains, certificates, and IPs the way an attacker would, starting from public data.
Every alert checked by hand
An engineer confirms each new exposure before it reaches you, so every alert means something.
Rebuilt every week
Discovery reruns weekly, so new subdomains and open ports don't sit unnoticed for months.
Our Attack Surface Management Services Process
From First Map to Weekly Watch in Five Clear Steps
You approve the scope before discovery starts, review every unknown asset we find, and sign off on each fix before anything changes.
We list the domains, brands, cloud accounts, and IP ranges you know about, plus any companies you've acquired. You get a written scope and a fixed monthly price. If a free tool already covers a small footprint like yours, we'll tell you before we quote.
What's Included
What You Get With External Attack Surface Management
Each plan covers outside-in discovery, hand verification, risk ranking, and weekly monitoring, with cloud accounts, internal inventory matching, and hands-on fixes on the larger plans.
Compare Options
DeveloperLook vs an ASM Platform vs In-House IT
Attack surface management companies that sell platforms suit teams with analysts to work the alerts, and in-house IT knows its own systems best. Here is where each option holds up.
| Feature | DeveloperLookBest fit | ASM platform | In-house IT |
|---|---|---|---|
| Discovery | Weekly, from public sources | Continuous and automated | Known systems only |
| Verification | Every exposure checked by hand | Left for your analysts | When time allows |
| Unknown assets | Owners traced and confirmed | Flagged, owner unknown | Often missed |
| Cloud coverage | AWS, Azure, and Google Cloud | Connector setup needed | Console spot checks |
| Fixes | Included on larger plans | Not included | Done in-house |
| Reporting | Monthly report and review call | Self-serve dashboards | Ad hoc |
| Setup effort | We run it for you | Setup and tuning | No new tools |
| Cost | From $450 per month | Annual platform license | Staff time |
DeveloperLook
ASM platform
- Discovery
- DeveloperLook: Weekly, from public sourcesASM platform: Continuous and automated
- Verification
- DeveloperLook: Every exposure checked by handASM platform: Left for your analysts
- Unknown assets
- DeveloperLook: Owners traced and confirmedASM platform: Flagged, owner unknown
- Cloud coverage
- DeveloperLook: AWS, Azure, and Google CloudASM platform: Connector setup needed
- Fixes
- DeveloperLook: Included on larger plansASM platform: Not included
- Reporting
- DeveloperLook: Monthly report and review callASM platform: Self-serve dashboards
- Setup effort
- DeveloperLook: We run it for youASM platform: Setup and tuning
- Cost
- DeveloperLook: From $450 per monthASM platform: Annual platform license
Projects We've Built
HR, Fintech, and Education Projects We Have Built
Websites, dashboards, and apps we built for HR, fintech, and education teams. Each one adds domains, logins, and hosts to a company's attack surface.
Herile HR and Project Management Platform Website
- Business
- Dashboard
- SaaS Platform
Finto Corporate Website Design & Development
- Finance
- Dashboard
- Website
Gradely E-Learning Website Design & Development
- Education
- Dashboard
- Membership Platform
Login HR Staffing App Design & Development
- HR & Staffing
- Portal
- Dashboard
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built apps, platforms, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Security Teams Trust Us With Their Exposure Map
Mapping a company from the outside means holding a list of its weak points. These habits keep that map accurate, private, and focused on what you can act on.
Passive discovery comes first
We map from public data before touching any system. Active checks run only on assets you've confirmed as yours, inside the scope you signed.
Owners confirmed, not guessed
Before we flag an unknown host as yours, we trace it through DNS, registrar, and hosting records. Your team won't lose a day chasing someone else's server.
Alerts worth opening
We send fewer, checked alerts instead of raw platform noise. Each one says what changed, why it matters, and what to do next.
Findings kept private
Your exposure map lives in your workspace and travels only by access-controlled link. A list of your weak points stays out of shared inboxes.
Honest about blind spots
Outside-in discovery can't see everything, such as hosts with no public DNS name. We tell you what the map may miss and how to close that gap.
One flat monthly fee
Your plan has a fixed monthly price and a published domain limit. Fix hours are listed per plan, so the invoice matches the proposal.
Overview
What do attack surface management services include?
DeveloperLook provides attack surface management for companies whose online footprint has outgrown their asset list. We map domains, subdomains, certificates, open ports, and cloud assets from the outside every week, confirm each exposure by hand, and help close it. Plans start at $450 per month, and the first full map takes 1 to 2 weeks.
DEVELOPERLOOK
Project facts · Attack Surface Management Services
- Service
- Attack surface management services (discovery, verification, weekly monitoring, fixes)
- Typical timeline
- First full map in 1 to 2 weeks, then weekly discovery runs
- Platforms
- Public DNS, websites, IP ranges, AWS, Azure, and Google Cloud
- Built with
- OWASP Amass, Subfinder, httpx, Nmap, Shodan, and Certificate Transparency logs
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- Monthly review call and email support on every plan
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $450 USD per month
Reviewed 22 Oct 2026 by Saimul Islam
Good fit
Companies after a merger or acquisition
You've acquired a company and inherited domains, servers, and cloud accounts nobody documented, and you need to know what's exposed before integration.
Brands with years of campaign microsites
Your agencies have launched campaign sites and landing pages for years, and nobody knows which are still live, patched, or pointing somewhere dangerous.
SaaS teams with growing cloud footprints
Your engineers spin up test environments in AWS every sprint, and you want cloud attack surface management that catches the ones left public.
IT leads preparing for an audit
Your auditor asks how you handle cyber attack surface management, and a spreadsheet of assets updated once a year won't hold up.
Agencies managing many client domains
You host and manage dozens of client domains and want continuous attack surface management across them without buying a platform per client.
Not a fit
Need a one-time assessment
You want a single dated report of weaknesses on systems you already know about, not weekly monitoring. Our vulnerability assessment services fit that better, from $700.
Leaked passwords are the worry
Your main concern is staff credentials and company data turning up in breach dumps and criminal forums. Our dark web monitoring service watches for exactly that.
Already run an ASM platform
You already pay for an attack surface platform and have analysts working its alerts. Adding us would duplicate work, unless you only need help with the fixes.
Budget under $450 a month
Your budget is under $450 a month and you run one or two domains. A free certificate log search and a yearly external scan cover the basics.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for Attack Surface Management Services
These are monthly starting points in USD. Your plan depends on the number of root domains, cloud accounts, and fix hours, and you get a fixed proposal after a free baseline call.
For companies with a few domains that want every new exposure caught and explained early.
$450/month
- Free baseline call and first full map
- Up to 5 root domains rediscovered weekly
- Subdomains, IPs, ports, and certificates tracked
- New exposures checked by hand within 48 hours
- Monthly ranked fix list and report
- Monthly review call and email support
Recommended
For growing teams with cloud accounts, several brands, and no time to chase exposures.
$750/month
- Everything in Exposure Watch
- Up to 15 root domains
- Up to 3 AWS, Azure, or Google Cloud accounts
- Public code repositories checked for leaked keys
- Up to 3 hours of fixes each month
For companies that want internal attack surface management matched to the external map, with fixes.
$1,150/month
- Everything in Managed ASM
- Up to 40 root domains and 8 cloud accounts
- Internal asset inventory matched to the external map
- Quarterly hands-on check of the top 10 exposures
- Up to 8 hours of fixes each month
For Agencies
White-Label Attack Surface Monitoring for Agencies and MSPs
You own the client relationship. We map and watch your clients' domains under your brand, confirm every exposure by hand, and hand you checked alerts to pass on. You look proactive without hiring a security analyst.
How the partnership works
White label: your client only ever sees your brand
- Your client
- You, the agency
- DeveloperLook
Share client domains
Send each client's domains, brands, and cloud accounts, plus any recent acquisitions.
- Client needs
- You share the details
- Details received
We scope each client
You get a written scope and a fixed monthly price for every client.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Map, watch, report
We run weekly discovery and send checked alerts and reports in your template.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
Stay client-facing
Alerts and reports go out under your name and logo.
One map per client
Each client gets its own scope, asset map, and monthly report.
Checked alerts only
Every exposure confirmed by an engineer before you pass it on.
Fixes on request
We close dangling DNS records and open ports once your client approves.
The Right Technology for Your Project
Technology Stack
Open-source discovery tools and public data sources build the map, and engineers check what they find. Nothing gets probed until it's confirmed as yours.
- OWASP Amass
- Subfinder
- httpx
- crt.sh certificate search
- Nmap
- Nuclei
- Shodan
Burp Suite
AWS- Microsoft Azure
Google Cloud
Cloudflare
Slack
Google Sheets- Jira
- Email alerts
FAQ
Frequently Asked Questions
Straight answers on cost, timing, external and internal coverage, monitoring, and who fixes what we find.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Attack surface management services from DeveloperLook start at $450 per month for up to 5 root domains, weekly discovery, hand-checked alerts, and a monthly report. Up to 15 domains, 3 cloud accounts, and 3 fix hours a month move you to $750 per month. The $1,150 per month plan covers 40 domains, internal inventory matching, and 8 fix hours.
The first full map of an attack surface takes 1 to 2 weeks, depending on how many domains, brands, and acquisitions you have. Verifying unknown assets and agreeing the first fix list takes another 3 to 5 days. After that, discovery reruns every week, and new exposures are flagged within 48 hours.
Attack surface management is the ongoing work of finding, checking, and shrinking everything your company exposes to the internet. That covers domains, subdomains, IP addresses, open ports, certificates, cloud resources, and login pages. Unlike a one-time audit, the map is rebuilt continuously, so assets added next month get caught too.
External attack surface management covers only what someone outside your network can reach: public DNS, websites, IPs, cloud endpoints, and exposed services. It starts from public data such as Certificate Transparency logs and registrar records, not from your own asset list. That outside view is what finds the staging site or old microsite IT didn't record.
Attack surface management matters because you can't patch or protect a system nobody knows exists. Forgotten hosts tend to be unpatched and unmonitored, which makes them easy ways in. NIST CSF 2.0 and CIS Controls v8.1 both start with an accurate asset inventory, and outside-in discovery keeps the internet-facing part of that inventory honest.
Attack surface monitoring is the repeating part of the work: rerunning discovery on a schedule and alerting when something changes. Typical changes are a new subdomain, a certificate for an unknown host, a newly opened port, or a cloud bucket made public. We rerun discovery weekly and confirm each change by hand before it reaches you.
In cyber security, ASM stands for attack surface management, the practice of discovering and reducing internet-facing exposure. You may also see EASM for the external part and CAASM for asset data pulled from internal tools. We focus on the external view and add internal attack surface management on the largest plan by matching both inventories.
Attack surface risk management ranks each exposed asset by how likely it is to be attacked and how much damage it could do. We weigh what's exposed (an admin login, a database port), whether a known exploited flaw applies, and what data sits behind it. You fix the top of that list first, instead of treating every subdomain alike.
Outside-in discovery finds assets your scans skip, because scans only cover the IPs and domains you list. Common finds are old staging copies of live apps and test servers with SSH or database ports open to everyone. Another is a subdomain still pointing at a deleted cloud resource, which Microsoft warns attackers can take over.
Your team fixes exposures on the Exposure Watch plan, with written fix steps for each one. On the larger plans our engineers make the changes within the monthly fix hours: removing dangling DNS records, shutting forgotten sites, and closing ports. Every closed item is rechecked from the outside, so the next report shows it gone.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.