Start using any ImmuniWeb product instantly after a quick customization and secure online payment. Alternatively, request your free demo.

Total Tests:

ImmuniWeb® Discovery
Attack Surface Management and Dark Web Monitoring

ImmuniWeb® Discovery leverages OSINT and our award-winning AI technology to illuminate attack surface and
Dark Web exposure of a company. The non-intrusive and production-safe discovery is a perfect fit
both for continuous self-assessment and vendor risk scoring to prevent supply chain attacks.

Attack Surface Management

Attack Surface Management

Rapidly detect, map and classify
on-prem and cloud IT assets

Continuous Security Monitoring

Continuous Security Monitoring

Detect misconfigured or
vulnerable IT assets

Non-Intrusive Technology

Non-Intrusive Technology

Production-safe OSINT technology
fits to score third parties

Dark Web Monitoring

Dark Web Monitoring

Detect stolen data and credentials,
and compromised systems

Instant Notifications

Instant Notifications

Get 24/7 alerts to relevant
people in your team

How it works

  1. Just enter a
    company name
  2. See what
    hackers see
  3. See what
    hackers do

Everything Visible. Everything Secure.

Compliance, Security and Vendor Risk Management

Prevent Data Breaches

Get instant alerts on vulnerable
or misconfigured IT assets

Simplify Compliance

Meet visibility, inventory & security
monitoring requirements

Outpace Cybercriminals

Respond without delay to security
incidents, data leaks or phishing

Cut Operational Costs

Get a helicopter view of your assets for
risk-based pentesting and patching

Minimize Human Risk

Receive instant alerts on shadow IT,
abandoned or forgotten assets

Prevent Supply Chain Attacks

Perform in-depth security scoring of your
vendors and suppliers

Threat Intelligence and Dark Web Monitoring

Surface Web
Deep Web
Dark Web

24/7 monitoring of your brand mentions in:

20+ Billion stolen credentials
10+ Million malicious domains
250+ threat intelligence feeds
50+ law enforcement feeds

Cloud Security Posture Management

Misconfigured or Exposed Cloud Services

Containers and CI/CD Pipeline Monitoring

Exposed Secrets in Code Repositories
Hardcoded Secrets in Container Images
Unprotected Container Orchestrators

Prevent Data Breaches and Supply Chain Attacks

Asset Discovery
Attack Surface Monitoring
  • APIs & Web Services

    Third-party and in-house REST/SOAP APIs and Web Services used by your web or mobile apps, or otherwise attributable to your company.

  • Public Cloud Services

    Cloud storage and cloud-native services in AWS, Azure and GCP including exposed repositories, serverless, API gateways, load balancers, queues and container management systems.

  • Domains & SSL Certificates

    A holistic list of your domain names and SSL certificates for subsequent expiration and validity monitoring.

  • Web Applications & Websites

    Your external web applications and websites that are used or operated by your company or are otherwise attributable to it.

  • Critical Network Services

    Exposed network services including SSH, FTP, VPN, RDP, LDAP, VoIP and email servers, and network devices or routers.

  • IoT & Connected Objects

    Connected objects ranging from CCTV cameras to building security systems, located in your digital premises and accessible from the outside.

  • Public Code Repositories

    GitHub and other public repositories with accidentally leaked source code belonging to your company, or malicious code targeting your company.

  • SaaS & PaaS Systems

    Over 200 third-party solutions ranging from Slack to Salesforce that process or handle your data and attributable to your company.

  • Mobile Apps

    Mobile apps attributable to your company from Apple Store, Google Play and over 20 other public mobile app stores.

  • Databases

    Over 50 types of databases spanning from MongoDB to Elasticsearch that are attributable to your company and accessible from the Internet.

Helicopter View of Your
External Attack Surface
Security Monitoring
Security Monitoring
  • Website Security

    Non-intrusive checks for over 10,000 known security vulnerabilities and misconfigurations in web CMS and frameworks.

  • WAF & CSP Presence

    Non-intrusive fingerprinting of Web Application Firewall and in-depth analysis of Content Security Policy configuration.

  • SSL Encryption & Hardening

    In-depth SSL/TLS encryption analysis on your external systems spanning from web applications and APIs to cloud and email servers.

  • PCI DSS & GDPR Compliance

    Non-intrusive checks for relevant security controls and requirements imposed by PCI DSS, GDPR, NIST, HIPPA, CCPA and other regulations.

  • Software Composition Analysis

    Detection of over 250 web CMS and frameworks, and over 150,000 of their plugins, themes and extensions.

  • Expiring Domains & Certificates

    Monitoring for expiring domain names and SSL certificates, including certificates’ validity.

  • Malware & Black Lists Presence

    Monitoring for IP addresses and domains belonging to your company for presence in various black lists, from spam lists to IoC and hacking activities lists.

  • SPF, DMARC & DKIM Presence

    Monitoring for properly configured SPF, DMARC and DKIM records on your external email servers.

  • Mobile Application Security

    OWASP Mobile Top 10 scanning, mobile Software Composition Analysis and privacy assessment of your mobile apps.

  • Cloud & DB Security

    Monitoring for open public cloud storage and password-unprotected databases accessible from the Internet.

Production-safe Vulnerability
and Compliance Scanning
Dark Web Monitoring
Dark Web Monitoring
  • Stolen Credentials

    Monitoring for presence of your employees’ credentials in password collections and stolen databases on Dark Web marketplaces, IRC and Telegram.

  • Pastebin Mentions

    Monitoring of Pastebin, including deleted posts, and other paste websites for mentions of your company, domain names or IP addresses.

  • Exposed Documents

    Monitoring for leaked or stolen documents attributable to your company on Dark Web marketplaces and hacking forums.

  • Leaked Source Code

    Monitoring for accidently or maliciously exposed source code on public code repositories such as GitHub.

  • Breached IT Systems & IoC

    Monitoring for mentions of your systems on Dark Web marketplaces and hacking forums, enhanced with monitoring of threat intelligence and IoC lists.

  • Phishing Websites & Pages

    Monitoring for newly registered phishing domains and created scam web pages targeting your company, its employees or clients.

  • Fake Accounts in Social Networks

    Monitoring for newly created accounts that impersonate your company in Facebook, Twitter, LinkedIn and other social networks.

  • Unsolicited Vulnerability Reports

    Monitoring for social networks and special Vulnerability Disclosure Platforms for security flaws impacting your systems or applications.

  • Trademark Infringements

    Monitoring for websites and domains trying to impersonate your company, its brands or trademarks.

  • Squatted Domain Names

    Monitoring for cyber- and typo-squatted domain names involving your company name or brand.

Proactive and Timely Reaction
to Security Incidents
One-Click Data Export for DevSecOps
  • JSON
  • XLS
  • PDF

ImmuniWeb® Discovery Packages

Attack Surface Management and Dark Web Monitoring

Discovery Enter

1 Enter Your Company Name

Just enter a company name to run
open-sourced intelligence scan
of its entire attack surface

Discovery Dashboard

2 See What Hackers See

Explore on-premises systems and
cloud resources where the data
is stored or processed

Discovery Alerts

3 See What Hackers Do

Detect data breaches, compromised
accounts or systems, stolen data,
phishing and brand misuse

ImmuniWeb® Discovery
Corporate Pro
Express Pro
Access to Security Analysts
Yes Yes Yes Yes
Domain & Subdomains Discovery
Yes Yes Yes Yes
Web Applications & API Discovery
Yes Yes Yes Yes
Mobile Applications & API Discovery
Yes Yes Yes Yes
Security & Compliance Monitoring
Yes Yes Yes Yes
Multicloud Resources Discovery
Yes Yes Yes
Network Services Discovery
Yes Yes Yes
Cyber Threat Intelligence
Yes Yes
Repositories Monitoring
Yes Yes
Dark Web Monitoring
Yes Yes
Phishing Monitoring
Yes Yes
Brand Monitoring
Yes Yes
Access to Dark Web Analysts
Phishing Websites Takedown
24/7 Every Day Every Week Every 2 Weeks
Annual Subscription
per month
per month
per month
per month
Monthly Subscription
per month
Packages per Year: 25
Volume Discount: 10%

Why Choosing ImmuniWeb® AI Platform

Instant start. Rapid Delivery.

Gartner Cool Vendor
SC Awards Winner
IDC Innovator
Globally Trusted
1,000+ Enterprise Clients
250+ Business Partners
50+ Countries
Proven Success
90% Customer Retention
70% YoY Sales Growth
Zero Breaches of SLA

Frequently Asked Questions

  • Q
    How many IT assets can I include into my subscription?
    There is no limit for the number of IT assets or Dark Web mentions per company, but each company requires a separate subscription. If you have multiple brands or companies to monitor, please get in touch to get a special quote. You may have unlimited number of users per project with granular permissions.
  • Q
    Do I have to deploy any on-premise agents or software?
    No, we normally detect 99.9% of externally visible and accessible IT assets located on premises or in a cloud by using a wide spectrum of OSINT-based methodologies, network reconnaissance and our proprietary sets of Big Data. To start a Discovery project all you need to do is enter the name of your company: your interactive dashboard with first results will be ready in 3 days. While your subscription is active, we will continuously monitor your external Attack Surface for changes and automatically add new IT assets at no additional cost.
  • Q
    How can you test security of my Microsoft Azure, AWS or GCP?
    We rapidly detect your multicloud attack surface and external cloud assets including various types of data storage, gateways, load balancers, databases and other external cloud instances in AWS, Azure, GCP and over 50+ other public cloud service providers. In addition to illuminating your cloud attack surface for various misconfigurations, excessive access permissions or default IAM policies, we also map your geographical data storage for compliance and regulatory purposes. Unlike other vendors, you don’t need to provide us with a cloud IAM account, just enter your company name to run cloud discovery and start continuous cloud monitoring.
  • Q
    Do I need a permission to run Discovery on third parties?
    Generally, no formal authorization is required as we use only non-intrusive OSINT (Open Source Intelligence) discovery and production-safe security evaluation methodologies. To maintain transparency in your Third-Party Risk Management program, you may wish to notify your vendors in advance.

Trusted by 1,000+ Global Customers

Gartner Peer Insights
Book a Call Ask a Question
Talk to ImmuniWeb Experts
Have a technical question?

Our security experts will answer within
one business day. No obligations.

Have a sales question?
Tel: +41 22 560 6800 (Switzerland)
Tel: +1 720 605 9147 (USA)
Your data will stay private and confidential