Discovery

Attack Surface Discovery (EASM)

Most companies cannot say exactly how many assets they expose to the internet. The `staging` server an agency stood up years ago, the `test` subdomain a developer forgot, the old panel everyone assumed was shut down — all still running, all still speaking in your name. Specula maps what lives under your domain using Certificate Transparency records, Cloudflare, and dictionary scanning together.

• Three sources, used together

  No single method finds everything. Certificate records, DNS, and dictionary scanning combined surface the assets each one would miss alone.

• Flags the forgotten doors

  Names like `test`, `old`, `staging`, and `whm` are called out specifically. They are usually the least maintained and the most forgotten.

• The value starts after the first scan

  The first scan is an inventory. After that, Specula reports every new asset that appears — because the risk is the door opened without your knowledge.