DedSec Security Research
"Autonomous" is doing a lot of work in most attack surface management copy, so it is worth being precise about what it should mean. It does not mean the tool decides things on your behalf. It means the pipeline runs end to end without a human feeding it a list of assets, and it keeps running after the first report is written.
That pipeline has six distinct stages, and they fail in different ways. Most disappointment with external attack surface management comes from buying a product that is strong at one stage and treating it as though it covers all six.
Discovery starts from a domain name. Not a spreadsheet of hosts, not a CMDB export, not a range of IPs your network team believes it owns — a domain, because that is all an attacker starts with too.
From there the work is enumeration: subdomains, DNS records, certificate transparency logs, resolved infrastructure, live services. Maphra runs this agentless, with no credential into your estate and no network access, for the same reason an attacker has none. The moment a discovery tool needs to be told where to look, it can only find what somebody already remembered.
The interesting output of discovery is rarely the assets you expected. It is the marketing microsite a contractor registered, the staging host that outlived the project, the subdomain still pointing at a cloud bucket that was deprovisioned two years ago.
This is the stage that separates a usable surface from a noisy one, and it is where naive tooling quietly hurts you.
Enumeration produces things that respond. It does not produce things you own. A shared CDN edge, a payment provider, a SaaS vendor's login page on your CNAME, a host that happens to sit on the same IP as yours — all of them show up. Attribution is the judgement that connects a discovered asset back to your organisation, and getting it wrong is expensive in both directions. Attribute too loosely and your inventory fills with other people's infrastructure. Attribute too tightly and the forgotten host — the one you actually needed to see — falls out.
Attribution also has a safety consequence, which we come back to below: it determines what any active testing is allowed to touch.
Once an asset is attributed, it needs to be described. What is running, what version it reports, what the certificate says, whether the DNS record is of a kind that can be taken over, whether the endpoint is an API, an admin panel or a brochure page.
Classification is what makes the rest of the pipeline cheap. Analysis that runs blind against every asset wastes effort on things that cannot be affected; analysis that knows an asset is a Kubernetes ingress, or a mail host, or a dangling CNAME asks better questions.
Analysis is the part everybody pictures when they think of a scanner: TLS and certificate posture, security headers, DNS hygiene, email authentication, misconfiguration, exposed interfaces. Maphra runs these checks across every discovered asset, and re-runs them on a schedule, diffing the result against the last known surface so you get what appeared, what changed and what disappeared rather than a fresh undifferentiated list.
The important discipline here is that each finding keeps the raw response that produced it. A finding without evidence is an assertion, and an assertion cannot be triaged, disputed or audited.
Analysis tells you a service reports a vulnerable version. That is inference, not proof. Version banners lie in both directions: backported patches make a patched host look vulnerable, and a stripped banner makes a vulnerable host look fine.
Validation is where Maphra actively checks whether the exposure is real against the live asset, so a finding arrives with evidence rather than a severity guess. Two things about this need saying plainly.
First, the scope boundary. Active validation runs only inside an explicit scope boundary that you define. A scope gate keeps active checks off third-party hosts that merely appear in your discovered surface — the CDN, the SaaS login page, the shared-hosting neighbour. Attribution feeding validation without a gate is how an EASM product ends up testing somebody else's infrastructure on your behalf, which is a legal problem before it is a technical one.
Second, what this is not. Autonomous validation is not a penetration test and does not replace one. It does not reason about your business logic, it does not chain a session-handling quirk into an authorisation bypass the way a human tester will, and it does not write you a narrative of how far an adversary could get. What it does is remove the largest category of wasted triage: the theoretical finding that nobody can confirm or dismiss. Treat it as the evidence layer under your remediation queue, and keep the human exercise for the things humans are better at.
The final stage is deciding what to fix first, and it is where most programmes actually fail. A team handed ten thousand findings does not fix the top ten; it fixes whatever is easiest and loses confidence in the tool.
Prioritisation needs three inputs working together. Deduplication, so the same issue found on six scans is one item with a history rather than six items. Correlation with exploit intelligence, so a CVE raises an alarm when it touches an asset you actually operate rather than when it trends. And reachability, so the exposure that an unauthenticated request can reach outranks the one behind three controls.
Then it needs somewhere to go. Findings in Maphra move through new, reopened and fixed, carry ownership and an SLA, and are tracked to closure. "Reopened" is the state that earns the whole model: it is the difference between knowing a fix regressed and re-discovering the same problem for the fourth time.
If you are evaluating any external attack surface product, including ours, the questions that separate them are unglamorous:
A product that answers those five well is doing attack surface management. A product that answers only the first is doing inventory, which is useful, but it is not the same thing and should not be priced as though it were.