// VEYRA SURFACE
See what the internet sees.
The asset that causes the incident is usually the one nobody remembered was still running. Veyra Surface keeps an inventory of what your authorized domains actually expose, and tells you when that changes.
Domain and subdomain inventory
A maintained list of the hosts under your authorized domains, including the ones created for a demo two years ago and never decommissioned.
Public application discovery
Which hosts serve an application, what it appears to be, and whether it sits behind authentication.
Public API discovery
API hosts and reachable route prefixes, cross-referenced against the inventory built from your source code.
TLS configuration
Certificate validity and expiry, protocol versions, cipher configuration, and hosts that accept connections they should refuse.
Security headers
Content security policy, transport security, frame options, referrer policy, and the gaps between what is set and what the application needs.
Technology fingerprinting
Server software, frameworks, and third-party components identified from public responses, then matched against known vulnerable versions.
Unexpected exposure
Administrative interfaces, staging environments, debug endpoints, database ports, and object storage that is reachable when it should not be.
Change detection
A new host, a newly opened port, a service that changed, or a certificate about to expire — surfaced as it happens rather than at the next audit.
Nothing is tested until you authorize it.
External security testing without permission is not a grey area. Before any external check runs, Veyra records an explicit authorization from a person entitled to give it.
- AUTHORIZED ORGANIZATION
- The legal entity granting permission.
- AUTHORIZED DOMAINS
- The exact domains and subdomains in scope.
- AUTHORIZED APPLICATIONS & APIS
- The specific applications and API hosts included.
- ENVIRONMENT RESTRICTIONS
- Production, staging, or development, and what differs between them.
- EXCLUDED ENDPOINTS
- Anything explicitly out of scope, honored on every run.
- MAXIMUM REQUEST RATE
- The ceiling Veyra will not exceed against your infrastructure.
- MAINTENANCE WINDOWS
- Periods when testing is suspended entirely.
- AUTHORIZING INDIVIDUAL
- Who granted permission, when, and against which version of the agreement.
What non-destructive means here
Veyra does not attempt to exploit, modify, delete, or exfiltrate data during external monitoring. It does not run denial of service testing, credential stuffing, or brute force. Where a check could plausibly cause disruption, it is not run automatically — it is proposed to you first with a defined, safe procedure.
A surface finding in context.
On its own, a staging host is an inventory note. Correlated with the rest of the picture, it can be the finding that matters most this week.
The staging host runs the same application as production, against a copy of production data, without the WAF in front of it and without the authentication changes shipped last quarter. Veyra Intelligence links the exposed host to the code that runs on it and to the data it can reach, and raises a single correlated finding instead of five disconnected warnings.
How correlation worksCommon questions
How do you verify we own a domain?
Will monitoring set off our alerts?
Do you scan our cloud accounts?
Start with a baseline assessment.
Authorize your assets and receive a prioritized view of what is actually exposed.