What changed on your estate since the last test.
Cadence
Three intervals, and none of them is every minute
Monitoring runs on a schedule you can write down. Here is the whole of it.
- Every 24 hours
A lightweight check
The hostname is resolved, the TLS certificate is read, and open ports are compared against the previous snapshot. It is cheap enough to run daily and it catches most of what actually moves between engagements.
- Weekly or monthly
A full scan
You choose the cadence for each asset, or set it to off and keep only the daily checks. Weekly is the default. This is the deep pass, and it is the one deliberately not run every day.
- Weekly
Host discovery
Certificate transparency records are read for names belonging to your domains, and each name found is probed. The part of an estate that gets breached is usually the part nobody remembered owning.
Why the deep scan is not daily: a full scan against an unchanged target returns the same answer it returned yesterday, at real cost in time, bandwidth and load on your systems. The daily check exists to notice that the target changed. The full scan exists to examine it properly. Collapsing the two into one nightly deep scan would buy you a longer job list, not earlier knowledge. If another provider tells you they scan without pause, the useful question is what they run and how often.
Events
Twelve things it will tell you about
Each event carries a severity of informational, low, medium or high, and each can be acknowledged. The list you look at is what you have not dealt with, rather than everything that has ever happened.
Hosts and ports
- New host discovered
- Port opened
- Port closed
The shape of the estate. A port that opened between engagements is the change most likely to matter, and a host discovered for you is one that was never in scope because nobody knew to put it there.
Certificates
- Certificate expiring
- Certificate changed
- Certificate invalid
Read on every daily check. Expiry is the one that takes services down without an attacker involved, and a certificate that changed without anyone expecting it to is worth a question.
Reachability and DNS
- DNS record changed
- Host stopped responding
- Host responding again
Both directions are raised. A host that went quiet may have been decommissioned or may be down, and a host that came back after weeks of silence is a change in your attack surface either way.
Schedule and authorisation
- Monitoring paused
- Authorisation expiring
- Authorisation expired
The schedule reports on itself. If monitoring stops, that is an event rather than silence, so an asset going quiet can never be mistaken for an asset with nothing to report.
Authorisation
The expiry is a feature, not an inconvenience
Monitoring means holding a list of targets we are permitted to scan on a schedule. Four controls make that list safe to hold.
You prove you own it first
Before anything is scheduled against a target, control of it is verified by a DNS record you publish or a file you place on the host. Nothing is monitored on the strength of somebody typing a domain name into a box.
Permission expires after 365 days
Standing authorisation lasts a year, then the schedule stops on its own. Warning events fire before it lapses, so renewing is a decision rather than a scramble. A permission with no expiry authorises scanning for ever, long after anyone remembers agreeing to it.
Pause, with the reason recorded
Monitoring can be paused on an asset at any time and the reason is stored with it. A change freeze, a migration, a decommissioning in progress: the record says which, so the gap is explained rather than unexplained.
A snapshot per asset
Addresses, open ports, certificate and reachability are stored for every monitored asset. Change is detected by comparing each check against that snapshot, which is what lets the platform report a difference rather than a reading.
Allowance
Metered per asset, not per run
Included in the plan, not a separate licence, so changing how often an asset is scanned never changes the price.
| Plan | Monitored assets | What that means |
|---|---|---|
| Single assessment | 0 | Monitoring is not included. The engagement, live findings and retests are unaffected. |
| Annual programme | 5 | 5 assets watched daily, each with a full scan on the cadence you set, plus weekly host discovery. |
| Continuous testing | 20 | 20 assets watched daily, each with a full scan on the cadence you set, plus weekly host discovery. |
Where this sits
This supplements manual testing. It does not replace it.
Monitoring watches for change on a schedule. It notices a new host, an opened port, a certificate about to expire. It does not chain a multi-step authorisation flaw, abuse business logic, or reason about what your application is for. That work is done by a tester, by hand, and the engagement remains the assessment.
The two fit together. The engagement establishes what is true across your estate in depth. Monitoring tells you when the ground it was assessed on has moved, so the next engagement starts from what your estate is now rather than what it was when somebody last wrote the scope. Findings raised by a scheduled scan are kept separate from the findings a tester wrote, so you always know which is which.
Monitoring FAQ
Monitoring questions, answered exactly
Including the numbers, because a schedule described in adjectives is not a schedule.
How many assets can we monitor?
Five on Annual programme and twenty on Continuous testing. A single assessment does not include monitoring. The allowance is metered per asset rather than per run, and it is part of the plan rather than a separate licence, so changing how often an asset is scanned does not change what it costs you.
Can we keep the daily check and turn the full scan off?
Yes. The full scan cadence is set per asset to weekly, monthly or off, and weekly is the default. Turning it off leaves the daily check running, which is often the right choice for a host that rarely changes but whose certificate and open ports still matter.
What happens when our authorisation reaches a year?
The schedule stops. Standing permission lasts 365 days from the point you prove ownership, and warning events are raised before it lapses so the expiry is never a surprise. Renewing it starts the schedule again. This is deliberate: permission that never expires would keep authorising scans months after anyone reviewed the arrangement.
Can we pause monitoring during a change freeze or a migration?
Yes, and the reason is recorded with the pause. Monitoring paused is itself an event, so the record shows why an asset went quiet rather than leaving a gap that looks like a fault. Resuming picks up from the stored snapshot, so the first check after a pause still reports what changed.
How does it know something changed?
Each asset has a snapshot holding its addresses, open ports, certificate and whether it responded. Every check compares what it sees against that snapshot and raises an event on the difference, then updates it. Change detection is a comparison against a known previous state, not a judgement made on a single observation.
Tell us what your estate looks like.
On the scoping call we will agree what is worth monitoring, how often each asset should be scanned, and how it fits around the manual testing that does the real assessment.