Attack Surface and Attack Path Analysis
Internal Asset and Service Discovery
We identify the systems and services actually running on your internal network. We compare the results with your inventory and highlight the differences.
What it is
Internal asset discovery reveals all devices connected to your network and the services running on them. Over time, inventory records and the actual network state diverge. Discovery combines network scanning with DHCP, DNS, EDR and virtualization records. This makes systems missing from the inventory and unexpected open services visible.
Scope
- Scanning selected network segments for devices and open services
- Combining DHCP, DNS, EDR and virtualization records
- Identifying operating system and software versions, flagging those out of vendor support
- Comparing discovered assets with the CMDB or inventory
- Listing systems without an EDR agent or that do not send logs
The need
When organizations need it
- When an unauthorized device is discovered on the network by chance.
- When an incident reveals that the system used by the attacker was never in the inventory.
- When you need to identify which systems are in scope before an EDR rollout or network segmentation project.
Method
How we work
-
Scope and timing
We define the segments to scan, sensitive systems and scanning hours with you.
-
Passive sources
We create an initial list from DHCP, DNS, EDR and virtualization records. This step does not load the network.
-
Active discovery
We find devices and open services with low-intensity scanning. On sensitive systems, we use only passive methods.
-
Comparison
We match the results with your inventory. Extra, missing and inconsistent records are provided in separate lists.
Outcome
What you have at the end
You receive an asset list matched to your inventory, showing what is actually running on your network. Systems without EDR or logging, and unnecessary open services, are marked separately.
Frequently asked questions
Will scanning affect production systems?
Scanning speed and hours are agreed with you. Only passive sources are used for old or sensitive systems.
We already have a CMDB. Why is this needed?
A CMDB is only as accurate as the information entered. Discovery finds systems never recorded and services not shown in the records. You can use the results to correct your CMDB.
Are industrial networks included?
They can be included. For industrial control systems, passive traffic analysis is used instead of active scanning. This work is planned together with our OT security services.
Attack Surface and Attack Path Analysis
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting