Most organizations do not have a complete list of what they expose to the internet. A team opens a cloud account for one project and forgets it. Marketing launches a site on a new subdomain. A test server stays online after the test ends. Nobody keeps one list of all this, so nobody checks all of it. Attackers do not need the list. They scan the whole internet and find what is there.

Vulmon Recon is our answer to this problem. It is an external attack surface management (EASM) platform. You give it a domain, an IP range or a read-only cloud account. From there it finds what your organization exposes and keeps watching as things change.

What it does

Vulmon Recon has four core capabilities.

Asset discovery. Starting from one domain, it maps subdomains, IP addresses, open ports, live websites and the technologies behind them. Assets come with evidence: screenshots of live websites, DNS records, WHOIS data, ASN and location. This helps you decide what an asset is and who owns it.

Cloud and shadow cloud. You can connect AWS, GCP, Azure and Cloudflare accounts with read-only access. Recon lists the resources they expose and adds them to the same inventory. It also flags IP addresses at the major cloud providers that are not attributed to any connected account, and it does this even before you connect an account. This is often the first sign of a cloud account the security team does not know about. We wrote a separate guide on finding shadow cloud accounts from the outside.

Vulnerabilities and misconfigurations. Recon matches the products and versions it detects against known CVEs. Each finding carries its CVSS score, a CISA KEV flag and an EPSS score, so you can see at a glance which vulnerabilities are actually being exploited. It also checks for common misconfigurations such as missing security headers, missing HTTPS redirects and open directory listings.

Certificates. Every certificate on your attack surface is tracked from discovery to expiry. Each endpoint gets a TLS grade, with weak ciphers and old protocol versions flagged. New certificates issued for your domains are found in Certificate Transparency logs, including the ones you did not request.

Beyond these four, Recon watches domain registrations that are about to expire, database and admin ports open to the internet, and public storage buckets in the cloud accounts you connect.

Everything works from the outside, the way an attacker sees you. There is nothing to install and no code to change. Recon maps, fingerprints and runs non-destructive checks. It never exploits a vulnerability and never changes anything on your systems. Heavy scanning runs only on assets you have confirmed in scope. A newly discovered asset gets one light pass, enough to show you what it is, and then waits for your decision. You control scan windows and exclusion rules.

How it differs from a vulnerability scanner

A vulnerability scanner starts from a list of assets you give it and checks them, usually from inside your network. It is good at checking known systems in depth. Vulmon Recon starts from the outside and looks for the assets that are not on any list. The two do different jobs. Recon tells you what you have and what is exposed. Your scanner examines what you already know. Most teams need both. We explain the split in What a vulnerability scanner cannot see.

Recon fits into the tools you already run. It can open a finding as a Jira, ServiceNow or GitHub issue. It notifies you in Slack, Microsoft Teams or by email when a new asset or a new finding appears. You can export the inventory as CSV or read everything through its REST API. Reports are built in: executive summaries, asset inventories and attestation reports mapped to ISO/IEC 27001, PCI DSS, DORA, BDDK and BİGR.

Pricing

Every plan includes the full product. There are no feature tiers, no per-user fees and no support tiers. Plans differ by one number: how many assets (domains and IP addresses) you keep in scope. Users and teams are unlimited. A small team gets the same product as a large one. You pick a size and change it as your attack surface changes. The numbers are on the pricing page.

Who built it

Vulmon Recon is built by the team behind vulmon.com, a free vulnerability search engine online since 2017. Vulmon Search helps you judge whether a vulnerability is worth fixing. Vulmon Alerts, with customers in 36 countries, tells you when a new one matches the products and topics you follow. Recon adds the third question: which of your own systems are exposed. The three work together, and each stands on its own.

Request a trial. Trials run for 14 days with the full product and no card on file. A person reviews every request before any scanning begins.