// VEYRA SURFACE

See what the internet sees.

The asset that causes the incident is usually the one nobody remembered was still running. Veyra Surface keeps an inventory of what your authorized domains actually expose, and tells you when that changes.

AUTHORIZED ASSETS ONLY · NON-DESTRUCTIVE CHECKS · RATE LIMITED BY YOUR POLICY
// 01 · INVENTORY
01

Domain and subdomain inventory

A maintained list of the hosts under your authorized domains, including the ones created for a demo two years ago and never decommissioned.

ASSETS
02

Public application discovery

Which hosts serve an application, what it appears to be, and whether it sits behind authentication.

APPS
03

Public API discovery

API hosts and reachable route prefixes, cross-referenced against the inventory built from your source code.

APIS
04

TLS configuration

Certificate validity and expiry, protocol versions, cipher configuration, and hosts that accept connections they should refuse.

TLS
05

Security headers

Content security policy, transport security, frame options, referrer policy, and the gaps between what is set and what the application needs.

HEADERS
06

Technology fingerprinting

Server software, frameworks, and third-party components identified from public responses, then matched against known vulnerable versions.

STACK
07

Unexpected exposure

Administrative interfaces, staging environments, debug endpoints, database ports, and object storage that is reachable when it should not be.

EXPOSURE
08

Change detection

A new host, a newly opened port, a service that changed, or a certificate about to expire — surfaced as it happens rather than at the next audit.

DRIFT
// 02 · AUTHORIZATION

Nothing is tested until you authorize it.

External security testing without permission is not a grey area. Before any external check runs, Veyra records an explicit authorization from a person entitled to give it.

AUTHORIZED ORGANIZATION
The legal entity granting permission.
AUTHORIZED DOMAINS
The exact domains and subdomains in scope.
AUTHORIZED APPLICATIONS & APIS
The specific applications and API hosts included.
ENVIRONMENT RESTRICTIONS
Production, staging, or development, and what differs between them.
EXCLUDED ENDPOINTS
Anything explicitly out of scope, honored on every run.
MAXIMUM REQUEST RATE
The ceiling Veyra will not exceed against your infrastructure.
MAINTENANCE WINDOWS
Periods when testing is suspended entirely.
AUTHORIZING INDIVIDUAL
Who granted permission, when, and against which version of the agreement.

What non-destructive means here

Veyra does not attempt to exploit, modify, delete, or exfiltrate data during external monitoring. It does not run denial of service testing, credential stuffing, or brute force. Where a check could plausibly cause disruption, it is not run automatically — it is proposed to you first with a defined, safe procedure.

A surface finding in context.

On its own, a staging host is an inventory note. Correlated with the rest of the picture, it can be the finding that matters most this week.

app.acme.exampleMONITORED
api.acme.exampleMONITORED
staging.acme.exampleUNEXPECTED
TLS 1.0 acceptedWEAK CONFIG
debug endpoint reachable[FLAGGED]

The staging host runs the same application as production, against a copy of production data, without the WAF in front of it and without the authentication changes shipped last quarter. Veyra Intelligence links the exposed host to the code that runs on it and to the data it can reach, and raises a single correlated finding instead of five disconnected warnings.

How correlation works

Common questions

How do you verify we own a domain?
During onboarding you confirm ownership or authorization for each domain, and Veyra records that confirmation as part of the authorization agreement. Domains that fail confirmation are not tested.
Will monitoring set off our alerts?
Possibly, and that is worth knowing before you start. Veyra publishes the source addresses its external checks originate from so you can allow-list or specifically watch for them, and every check respects the rate limits and maintenance windows you configure.
Do you scan our cloud accounts?
Attack surface monitoring works from the outside in and does not require cloud credentials. Deeper cloud posture analysis that reads your provider configuration is planned for a later phase and would require separate, explicit authorization.

Start with a baseline assessment.

Authorize your assets and receive a prioritized view of what is actually exposed.