Scans from the outside
Websites, APIs, every TCP port, encryption, and email and DNS, scanned on a schedule from our scanners, the way anyone on the internet reaches them.
Naxirion
Discover
Vulnerability Scanning
Vulnerability scanning you can believe.
Scans your websites, APIs, servers and email domains from the internet on a schedule, finds names under your domains you'd forgotten, and grades what it finds in plain English, including what it couldn't reach.
Open-source engines, run unmodified:
- ZAP
- Nuclei
- Nmap
- +3 more
Naxirion Discover with an example account. Every address in these screens is under .example.
What it does
Discover at a glance
Finds what you forgot
Names under your domains are looked up in certificate logs every week, and discovery flags names still pointing at hosting nobody owns. Nothing new is scanned until you add it.
Puts fixes in order
Every finding says whether CISA lists it as exploited and FIRST's estimate of how likely an attack is, with an owner, a fix-by date and advice in plain English.
Grades honestly
One letter for each target and for the account. A target we couldn't scan is named with the reason, and never counted as clean.
Inside the product
One list of risks, one grade, and the reasons for both
Every finding from every engine, written the same way, with what to do about it. The grade sits on top and never covers a target we couldn't look at.
Risks
Fix what attackers are using first
Every finding from every scan lands in one list, deduplicated and worst first. Open one and it says what it is, what to do about it, and whether attackers are using it, beside the severity and never instead of it.
- CISA's list of exploited vulnerabilities and FIRST's EPSS score on every CVE
- Owners, notes and fix-by dates, with anything overdue flagged
- Accept a risk with a reason and an end date, so it can't quietly become permanent
- Filter, work from the keyboard, and export to CSV or JSON
Targets
Every target graded, and the gaps said out loud
Each website, server and domain is graded A to F by the most serious thing still open on it. A target that couldn't be scanned isn't graded at all. It's listed with the reason and stays in the count, so it can't make your grade look better.
- Add many targets at once, tag them, and filter by tag
- Names found under your domains wait for you to decide
- A firewall filtering a scan is said, so a hidden site doesn't read as a clean one
- Every grade says what no scan tests: your application's own code
Scans
Know what every scan really did
Scans run on your schedule, grouped by what started them. Open one to see what it found, what's new and what it no longer sees. A scan that failed says why, and a failure that keeps happening is said once, plainly, instead of passing for a quiet week.
- Daily, weekly, monthly or quarterly, and held with the reason when a scan can't run
- Compare any two scans of a target
- Stop a running scan and keep what it finished
- Every run records the exact engine version and checks it used
New scan
Seven scans, each named after its tool
Pick what to look for and which targets to scan. Each choice is checked as you make it, so a scan that can't run tells you why before you start it. Every scan runs a well-known open-source engine, unmodified.
- Signs in to your web app and crawls what only a signed-in user sees
- Scans an API from its OpenAPI definition, with a token it proves works
- Passive by default. Active tests run only when you choose them
- Sign-in details are encrypted in your browser, for the scanner alone to open
Reports
A report the board can read
A branded PDF that opens with one page: the grade and what it covers, the three things to fix first, and a red, amber or green status that's never green over a gap. Then a page for each target, the history, and MITRE ATT&CK.
- Sent on a schedule, for the whole account or one part of it
- Excel, CSV and JSON exports that name what couldn't be scanned
- Board dashboards and a board pack with your own commentary
- Every finding mapped to the MITRE ATT&CK techniques it would help
For MSPs
Every client, under your brand
Run scanning for all your clients from one dashboard, under your own name, color and logo, on plans you set. Your clients see your brand on the portal, in their reports and in every email.
- Your own sign-in page, terms, and names for each scan
- Plans and limits for each client
- Correct a severity for a client, with the engine's own rating kept beside yours
- Run scanners of your own alongside ours
What it scans
Seven scans, grouped by what they protect
Each one runs a well-known open-source engine, unmodified, and is called by its name. And every week, without a scan, we look up the names certificates have been issued for under your domains.
ZAPWeb application scan
Crawls your site, signed in if you give it details, and checks every page it reaches. Passive, or with active tests that submit forms when you choose them.
Websites and APIs
NucleiVulnerability scan
Known vulnerabilities, exposed files, leaked secrets and misconfigurations, from a widely used library of checks.
Websites and APIs
NmapTCP/UDP port scans
Which of the 65,535 TCP ports can be reached from the internet and what is listening on each, plus services on UDP, such as DNS, SNMP and NTP, that a TCP scan can't see.
Servers and networks
testssl.shEncryption scan
Certificates, protocol versions and ciphers on any service that uses TLS, with one finding per problem.
Servers and networks
dnsx and our own analysisEmail and DNS
SPF, DKIM, DMARC, MTA-STS (its policy fetched and checked, not just the record), TLS-RPT, DNSSEC and CAA.
Domains and email
subfinderAttack surface discovery
Names under your domains from public sources, and names still pointing at hosting nobody owns any more.
Domains and email
The Nmap, ZAP and Nuclei names and logos belong to their projects. Naxirion isn't affiliated with or endorsed by them.
Where results go
Arrives where you already work
Besides new risks, you hear when a scan doesn't finish or a schedule stops running, because nothing looks wrong when that happens. A message that never arrived is shown as undelivered, never as sent.
- Email alerts, as they happen or as a daily or weekly summary
- Slack
- Microsoft Teams
- Signed webhooks
- An API, with keys that carry a role
- SAML single sign-on
- PDF reports on a schedule
- Excel, CSV and JSON
- A public scan badge
What it doesn't do
We'd rather tell you now than in a report
Test your own code
Flaws such as SQL injection in software you wrote need a penetration test. Every grade says so.
Scan inside your network
Discover looks at what faces the internet, from outside, the way an attacker would reach it.
Read what is installed
We see what a server shows the network, not the patch levels on it.
Scan what you haven't added
Nothing is scanned until it's added as a target, on the account owner's word that it's theirs to have scanned.
Or in a bundle
Essentials
Know what you have, keep it patched, and stop threats on every endpoint.
Compare bundlesFor MSPs
Sell it under your brand
Partners can white-label Naxirion Discover and offer it to clients under their own name.
Partner programPairs well with
Build out your coverage
See Naxirion Discover in action.
Book a demo and we'll walk you through it and show how it fits with the rest of your security stack.