Continuous discovery
Subdomain enumeration, DNS resolution, and WHOIS tracking run on a schedule you set. New infrastructure shows up in the inventory before anyone files a ticket about it.
Port & service scanning
Layered scanning — fast port sweeps, then HTTP probing and banner capture on what answers. You see the service, the version, and the screenshot, not just an open port number.
TLS & certificate posture
Protocol versions, cipher suites, expiry, and misissued certificates checked per host. Weak TLS on a forgotten mail host gets the same visibility as your main app.
Vulnerability matching
Template-driven vulnerability checks against discovered services, cross-referenced with NVD, EPSS exploit-probability scores, and the CISA KEV list — so severity reflects real-world exploitation.
Agent-triaged exposures
An exposure-triage agent reads each finding in context — asset criticality, exposure age, exploitability — and either promotes it to a tracked asset with an owner or closes it with a reason.
Change tracking
The surface is diffed run over run. A port that opened overnight, a certificate that changed issuer, a subdomain that started resolving — each lands in the change feed with its history.
Seed your domains
Give CTP247 your apex domains and known ranges. The discovery runners take it from there — enumerating subdomains, resolving DNS, and building the first inventory within hours.
Scan on your schedule
Port sweeps, HTTP probes, TLS checks, and vulnerability templates run continuously at an intensity you control — aggressive for pre-prod ranges, gentle for fragile legacy hosts.
Findings become exposures
Every result is normalized into an exposure record: what was found, where, when it first appeared, and what changed since the last run.
The agent triages
The exposure-triage agent assesses each new exposure against your stack and risk thresholds, promotes real issues to assets with owners, and writes its reasoning into the record.
You fix, it verifies
When the port closes or the cipher is removed, the next run records the remediation automatically — closing the loop without screenshots in a spreadsheet.
Under the hood