Attack Surface Management is where SITEY builds the list of what is actually on your network, including the machines nobody told you about. It sweeps the IP ranges you declare, separates hosts that run a SITEY agent from hosts that do not, and lets you layer your Active Directory graph on top, so network exposure and identity exposure sit on one screen instead of in two tools nobody opens together.
The problem
Every vulnerability programme starts with a list, and the list is almost always wrong. It lives in a spreadsheet that was accurate the week it was made. Agent-based tooling only sees the machines where somebody remembered to install the agent, which, by definition, excludes the printer in accounting, the NVR in the lobby, the test VM a developer spun up last quarter, and the switch that still answers on SNMP with a default community string. Those are exactly the hosts that never get patched, because they never appear in any report.
The identity side is usually worse. A SharpHound collection gets run once during an audit, opened in a graph tool on a consultant’s laptop, screenshotted into a PDF, and then forgotten. Six months later nobody can answer which accounts can still reach Domain Admin, and the collection ZIP is gone.
Without a discovery layer, your coverage number is unknowable. You can report “we have 412 assets and 96% are patched” while having no idea whether 412 is the real denominator.
Without SITEY
- A spreadsheet that was accurate the week it was made
- Agent-based tools blind to the printer, the NVR, the test VM and the switch with a default SNMP string
- A SharpHound collection run once, screenshotted, then forgotten
- A coverage number nobody can actually verify
With SITEY
- An inventory merged from a fresh sweep every hour
- Agentless hosts discovered and classified automatically
- The AD graph live and queryable next to the vulnerability queue
- One number: assets discovered versus assets covered
How it works
- You declare the networks you own
Discovery never guesses at the internet. You enter the VLANs or CIDR ranges you are responsible for, they are stored server-side, and nothing outside that list is ever swept. If the list is empty, SITEY falls back to deriving /24 networks from the private IP addresses your installed agents report, and that fallback accepts RFC 1918 ranges only, so loopback, link-local and public addresses are dropped. Ranges you type in yourself are used exactly as entered and are not filtered, so review the declared list before the first sweep and make sure every range is yours to scan.
- The sweep runs, in the depth you choose
Each subnet gets an Nmap host-discovery pass, then every host that answers is profiled for open ports. Four depths are available from the interface:
Mode What it does Fast Open TCP ports plus service names on a curated port list Balanced Adds light service-version detection Deep Wider port list including management and IoT ports, full version probing Deep + UDP Adds a top-ports UDP pass on top of Deep Subnet and host parallelism, host timeouts, timing template and packet rates are all settable through environment variables, so a sweep can be tuned down for a fragile OT segment or up for a flat office LAN. A sweep runs hourly in the background by default, and you can trigger one manually at any time. The manual run returns a job identifier and keeps going in the background, so closing the browser does not kill it.
- Managed and unmanaged get separated
Every result is compared against the IP addresses your agents report. A host that matches an agent is not listed as a stranger. Its ports, hostname and OS fingerprint are written back onto that agent’s record as enrichment, without overwriting values the agent itself supplied. Everything else becomes a discovered host: a real asset with no sensor on it.
Each host is then classified from its OS fingerprint and open ports into Windows, Linux, switch, camera or other. Separately, hosts that look like domain infrastructure are flagged as candidates with the evidence attached, Kerberos on 88, LDAP on 389, Global Catalog on 3268, SMB on 445, along with a domain name inferred from reverse DNS where one exists.
- The inventory is updated, never wiped
Results are merged into the permanent inventory keyed on IP address, and each record carries a last seen timestamp. A sweep that fails, or one that returns nothing because Nmap is missing or the VLAN list is empty, writes nothing at all. It cannot silently empty your asset list. Blank fields in a new result never overwrite good data from an older one. Hosts that stop answering are kept and age out through their timestamp rather than disappearing.
- The identity graph layers on top
Upload a SharpHound ZIP and it is stored under its own scan record, ingested, and rendered as an interactive graph of users, groups, computers, domains and their membership edges. Straight from the archive you can filter to a Tier-0 view built from high-value and adminCount objects, or switch to an edge-composition summary that collapses the graph into relationship types and counts. Searching for a principal by name and asking for a hop-limited path between two principals are answered by a graph backend, so those two need a Neo4j instance or a BloodHound CE endpoint connected. Collections are kept as history, and deleting one removes its findings with it.
What you can do
Sweep your declared VLANs at four depths, including an optional UDP pass.
Run discovery on a schedule and on demand, with job status you can watch and a run that survives a closed browser.
See agentless hosts as a distinct category instead of a gap in a report.
Get device-type classification and domain-controller candidacy with the port evidence that justified it.
Add discovered hosts to scan groups, so network scanners can reach assets that will never run an agent.
Move between three views of the same data: network topology grouped by VLAN, the identity graph, and a flat asset matrix.
Export the full asset matrix to CSV, category, IP, hostname, VLAN, OS, device type, open ports and count, risk, agent UUID, domain, last seen.
See every node coloured by the worst unresolved vulnerability on it, and a weighted 0-100 exposure index across open and in-progress findings.
Upload SharpHound collections, keep them as scan history, and delete a collection with its derived findings.
With a Neo4j instance or a BloodHound CE endpoint connected, generate Active Directory findings from a library of 199 prebuilt Cypher queries, Kerberoastable users, DCSync rights, AS-REP roastable accounts, SID history, ADCS escalation paths and more, with duplicate suppression when you re-run.
Import ADCS/ESC findings from that same backend, each carrying a remediation recommendation, attack steps and references.
Import a findings CSV exported from BloodHound CE if you prefer to collect elsewhere.
Hide the ASM screen in the interface from user accounts that have no business seeing it, a screen-level visibility flag rather than an API-level permission boundary.
Who it is for
Get a denominator they can defend and a fast answer to “is this IP ours, and does anything watch it?”
Get the unmanaged-host list that tells them where agent rollout actually stands, VLAN by VLAN.
Get the privilege graph in the same product as the patching, rather than in a tool they open once a year.
Get one number, assets discovered versus assets covered, that survives a board question.
Get an asset inventory with timestamps and an export, which is the first control every framework asks for.
Get port, service and graph data in one place instead of reassembling it from separate outputs.
Why it matters
The host that causes the breach is almost never the one on the patch report. It is the one that was never on any list.
Discovery is the cheapest control you will ever run, and it is the only one that makes every other control’s numbers honest, coverage, mean time to remediate, and compliance evidence all depend on knowing the true size of the estate. There is a direct time saving too. Reconciling an Nmap output against an agent list by hand is an afternoon’s work per subnet, and it is stale before the spreadsheet is saved. Here it happens hourly, by itself, and the difference between the two sets is the screen you look at.
On the identity side, a path from an ordinary user account to Domain Admin is not a CVE and no patch closes it. Which is precisely why it tends to go unowned for years. Keeping the graph next to the vulnerability queue means the question gets asked during normal operations rather than during an incident. Active Directory findings are kept in their own list, with their recommendations, attack steps and references attached; they are not turned into tickets in the patching workflow.
Discovered hosts count toward the IP allowance on your licence, the same as agent-covered hosts. Widening the VLAN list widens the estate you are licensing.
Works with
Discovered hosts flow straight into Asset Inventory, where they sit alongside agent-covered machines in one list. Agent Management is the other half of the coverage picture. The unmanaged-host count is your rollout backlog. Group Management lets you place discovered hosts into scan groups, which is how an agentless asset becomes a scan target. Network Reachability checks whether a target can actually be reached before a scan runs, so an unreachable host is reported as unreachable rather than as clean.
Frequently asked questions
Do I need an agent on every host for this to work?
No. That is the point of the module. Discovery is entirely agentless and works against anything that answers on the network, including devices that will never accept an agent. It does require Nmap to be installed on the SITEY server. A sweep that cannot find the binary writes nothing and leaves your existing inventory untouched, but the interface only reports that the run returned no results, so confirm Nmap is present on the server before reading an empty sweep as a clean network.
If a sweep fails or returns nothing, do I lose my inventory?
No. A failed or empty sweep performs no writes at all, and a successful sweep merges rather than replaces. Hosts that did not answer this time are kept with their previous last-seen timestamp. Manually added hosts and enrichment data survive sweeps.
Do I need BloodHound or Neo4j to use this?
Not for network discovery, which is independent of them. For the identity side, uploading a SharpHound ZIP and rendering its graph, including the Tier-0 and edge-composition views, works from the archive itself. Generating findings from the query library, running ADCS/ESC detection, searching for a principal by name or tracing a path between two principals needs a Neo4j instance or a BloodHound CE endpoint configured. Installation scripts and a Docker Compose file for that backend are included. If you would rather not run either, you can still import a findings CSV exported from BloodHound CE.
Can I control when and where discovery runs?
Yes. The scanned scope is only ever the VLAN or CIDR list you enter, or, if you leave that list empty, the /24 networks derived from the private addresses your agents report. The background sweep runs hourly by default and can be switched off with a single environment variable, leaving discovery entirely manual. Scan depth, parallelism, host timeouts and packet rates are all tunable for sensitive segments.
Your attack surface is already whatever it is; the only variable is whether you can see it. SITEY installs in your own infrastructure, so the inventory it builds, every IP, hostname, open port and AD relationship, stays on your servers and never reaches us. See pricing for the monthly and lifetime options, both with the full module set included.