Surface Intelligence

Overview

Surface Intelligence is your external attack surface outside active testing. It lists every domain and subdomain that your web app engagements discovered, or that left an engagement's scope, and that is not currently in an engagement's scan scope.

For each host, PENOPS records DNS, TLS, open ports and service banners, technology stack and matched CVEs, HTTP security headers, hosting, CDN and WAF, takeover and dangling-record risk, and the DNSSEC and mail posture of its zone. It then grades the host's risk and suggests a next step.

Open it from Intelligence > Surface Intelligence. Use it to triage new hosts: monitor the ones that matter, scan a host once, or suppress noise. Hosts that are in an engagement's scope appear on Exposure instead.

Statuses

A NEW badge marks a host first seen in the last 7 days that nobody on your team has opened yet. Opening the host clears the badge for everyone.

Triage a discovered host

1. Open Intelligence > Surface Intelligence. The first host opens in the right-hand panel.
2. Optionally press a KPI tile, such as Takeover risk, to narrow the list. Press it again to clear it.
3. Search with Search hostname, IP, org, or tech… or add filters.
4. Click a host. Read the AI Verdict, then the recon sections below it.
5. Act from the panel header: Promote to monitored, Scan now or Suppress.

What the panel shows

A stat strip shows First seen, Last seen, CVEs and Open ports. Below it, each recon section reports one area:

Takeover claimable means DNS shows someone could claim the name. Takeover confirmed means a scan observed it. A section that never ran is absent from the panel; a section that ran and found nothing is shown as checked.

About the AI Verdict

The AI Verdict is a short summary of the host's risk grade with a suggested next step, for example Promote and harden within the week. for a High host. It is a fixed template chosen by the risk grade, not output from a model reviewing the host, so treat it as a starting point and check the sections yourself. It appears once the host has a risk grade.

Monitor, scan or suppress

Monitoring and Scan now need the host's root domain to be verified with a DNS TXT record. You get the record in an engagement's targets step (see Create an engagement); subdomains inherit the verification.

Act on several hosts

1. Hover a host and tick its box. Once one is ticked, clicking another host adds it. The header shows N selected.
2. Choose Promote to monitored, Scan now or Suppress above the selection.
3. Read the outcome dialog, for example 9 promoted · 3 skipped. It lists each skipped host and why.

Each host succeeds or fails on its own. A bulk scan covers up to 100 hosts at a time. Your selection survives a search but clears when you change a filter, tile or grouping.

While a scan runs, the list and the open panel refresh every few seconds and each section shows Queued, Scanning, Done, Failed or Skipped. When it finishes, the host gets a check mark until someone opens it.

Run discovery for engagements

Run Surface Intel starts a discovery run that covers a whole engagement and everything in its scope. Only web app engagements offer it. New hosts it finds land on this page.

1. Click Run Surface Intel in the page header.
2. Pick Every engagement (one run per engagement that does discovery) or Selected engagements and tick the ones you want.
3. Check the footer, for example 3 runs will start., and click Start.

Engagements that cannot run are greyed out with the reason:

• This engagement is paused. Resume it to scan.
• This engagement is a draft. Activate it to scan.
• Surface Intel is off here. Turn a check on to scan.

The note Some Surface Intel checks are off. does not block a run. The checks are the engagement's recon modules: DNS & Certificate Discovery (which also covers DNSSEC and mail security), Technology Fingerprinting, Open Ports & Services and Domain & Subdomain Takeover Detection. Turn them on in Engagement settings.

Discovery is active as well as passive: alongside DNS and third-party datasets, it probes hosts for HTTP, TLS and open ports. Every run stays inside the engagement's scope.

Filter, group and export

Filter by Hostname, Parent domain, IP, Org, Engagement, Provider, Risk, Status, Tech, Open port, CVE, Liveness, Takeover or Dangling. The engagement picker in the header narrows the list to the engagements you choose.

The Asset list options menu offers:

• Group by: None, Engagement, Status, Parent domain or Provider.
• Toggle density.
• Hide unresolved names, to drop names that resolve to no address.
• Export CSV, which downloads the full filtered list, not just the rows loaded on screen.

To see suppressed hosts, add the filter Status = Suppressed. The list loads more rows as you scroll, newest discovery first.

The KPI tiles (Discovered assets, Critical risk, With known CVEs, Certificate expired, Takeover risk and Dangling DNS) count your whole discovered surface and do not change with filters. A dash means not loaded yet; 0 means none.

Permissions

Pentest > Exposure: Write also lets you monitor and scan hosts, and Pentest > Targets: Write also lets you suppress them, as long as you can open the page. See Team and permissions.

Good to know

• A name that resolves nowhere shows This name resolves nowhere. It is listed because discovery found the name. Suppress it, or leave it and a later sweep picks it up if a record returns.
• DNSSEC and mail security are per zone, so every host in a zone shows the same result.
• Takeover and dangling counts only include hosts a takeover check reached a conclusion on.
• The Liveness filter explains why a host did not answer, for example no DNS record, timed out, invalid certificate or not yours to test.
• In the Takeover filter, Not claimable matches hosts the panel shows as No takeover risk.