ONE-TIME
Exposure check
A short, fixed-scope look at what you expose to the internet.
- BlackBird external scan
- Asset and service inventory
- Prioritized findings
- Readout with your team
SECURITY PRODUCTS
See what's exposed. Then close it.
BlackBird looks from the outside. GhostScan looks from the inside. Both run on your own infrastructure, and both are built to work with the tools you already have.
THE PROBLEM
Two views of the same problem
Most small factories know they have internet-facing systems. Few know which ones, what's running on them, or which software versions are exposed. BlackBird and GhostScan answer those questions from different sides.
01 / DISCOVER
Find the asset
BlackBird maps subdomains, IPs, ports, and services that are reachable from the internet.
02 / INVENTORY
Identify the software
GhostScan turns host telemetry into a package and version inventory, then matches it to CVEs.
03 / PRIORITIZE
Decide what matters
Exposure, severity, and business criticality are compared before a fix list is written.
04 / FIX
Patch or isolate
Your team or ours patches, isolates, or adds a compensating control. Then we verify it.
01 / BLACKBIRD
BlackBird
External attack surface management
BlackBird continuously maps what you expose to the internet: subdomains, IPs, open ports, services, and the proxies or WAFs sitting in front of them. It keeps a baseline and tells you when something changes.
DISCOVERY
Subdomain discovery
Passive and active enumeration of domains and subdomains, merged into a target list.
SCANNING
Ports and services
Full TCP port scans with service fingerprinting, designed to avoid false positives from proxy edges.
FRONTING
WAF and proxy detection
CNAME checks and port-behavior heuristics identify Alibaba Cloud WAF and similar fronting.
CHANGES
Change tracking
New hosts, new ports, and disappeared assets compared against the previous run.
ALERTS
Alerting
DingTalk notifications and optional Aliyun SLS log delivery.
DEPLOY
Deployment
Docker-based scanner, scheduled jobs, private network or public VPS.
PIPELINE
How a scan runs
- Collect subdomains, IPs, and known assets into a target list
- Resolve CNAMEs and skip proxy-fronted hosts before full scans
- Run nmap and httpx in Docker against the remaining targets
- Diff services against the previous run and store the result
- Send new services and changes to DingTalk or SLS
- Keep an exportable history of assets and ports
Scans can run on a schedule or on demand. The scanner does not need inbound access to your internal network.
02 / GHOSTSCAN
GhostScan
Agentless software asset and vulnerability management
GhostScan reads host telemetry you already have, such as Splunk or OSQuery data, and turns it into a software inventory. It matches packages and versions against NVD, groups findings by manifest, and uses an LLM to explain what a CVE means in your environment.
AGENTLESS
No agent
Works from existing telemetry. No endpoint software to deploy or maintain.
INVENTORY
Software inventory
Packages, versions, and CPE matching across hosts.
MATCHING
CVE matching
NVD data with severity, affected versions, and host impact.
MANIFEST
Manifest view
Group findings by container image or software manifest.
AI
AI-assisted analysis
DeepSeek-assisted explanation of attack vector, impact, and mitigation.
VIEWS
Dashboards
Severity distribution, trends, and CVE search.
TELEMETRY
What it needs
- Splunk or OSQuery telemetry is the native input
- No Splunk or OSQuery? We plan a lightweight collection method
- Private deployment, with data staying in your environment
- Host, package, and version data mapped to CPE and CVE
- Findings grouped by manifest, image, or host
- Exportable reports for asset owners and management
Agentless does not mean effort-free. You still need telemetry from the hosts you want to cover. We help design that part.
TOGETHER
One from the outside, one from the inside
BlackBird tells you what the internet can see. GhostScan tells you what software is running behind it. Together they give your team a starting point for patching, firewall changes, and access review.
| Capability | BlackBird | GhostScan |
|---|---|---|
| Primary view | External, internet-facing assets | Internal host software and packages |
| Data sources | Subdomain enumeration, nmap, httpx, CNAME checks | Splunk, OSQuery, or other host telemetry |
| Core output | Asset, port, service, and change inventory | Software inventory, CVE matches, manifest groups |
| Change detection | Compares each scan to the previous run | Tracks software and vulnerability changes over time |
| Alerting | DingTalk, Aliyun SLS | Dashboard and report based |
| Deployment | Docker scanner, private or public network | Private deployment next to your telemetry |
ENGAGEMENT
Three ways to use them
Buy a one-time look, an ongoing subscription, or include the products in a larger build.
ANNUAL
Continuous visibility
For teams that need to know when something changes, not just once.
- BlackBird scheduled scans
- GhostScan inventory and CVE matching
- Monthly reports
- Alert integration
- Quarterly review
PROJECT
Integrated build
When the products are one part of a wider IT and security program.
- Network, endpoint, cloud, and security build
- Product deployment and integration
- MLPS gap analysis
- Training and handover
Want to see your own exposure?
Send us a domain and a rough asset count. We'll tell you what a first assessment would cover.