External attack surface management
See your perimeter
before attackers do.
ProbeIQ continuously monitors your external attack surface and turns raw scanner output into correlated findings, clear diffs, and reports anyone can read.
From $49/mo · 14-day free trial · founding-customer price lock
The connective tissue
Not another scanner. ProbeIQ is the intelligence layer over the best open-source engines — orchestration, correlation, continuous monitoring, and clean reporting.
- subfinder
- dnsx
- naabu
- httpx
- nmap
- tlsx
- nuclei
Why ProbeIQ
Findings you can actually act on
Correlated & de-duplicated
One finding with its full history across engines — not a pile of duplicate tool dumps. Every issue ties back to the asset it lives on.
What changed since last run
Every scan produces a readable diff: new, regressed, remediated, and newly-discovered assets — the report people will actually open each week.
Reports a stakeholder can read
Plain-language executive summaries, plus technical detail and asset inventory when you need to go deep.
- critExposed admin panel on api.example.com+ New
- highTLS 1.0 enabled on mail.example.com+ New
- medDirectory listing returned on cdn.example.com↺ Regressed
- lowMissing HSTS header — now fixed✓ Remediated
How it works
Safe by design, simple to run
- 01
Define a scope
List the domains, hosts and IP ranges you want watched — guided, not configured.
- 02
Verify ownership
Prove the assets are yours with a DNS TXT record or a signed attestation for IP space.
- 03
Sign an authorization
Capture the rules of engagement — intensity, rate limits, windows, blackouts, expiry.
- 04
Scan
ProbeIQ expands the work into isolated jobs and runs the engines in discovery → probe → assess order.
- 05
Correlated findings
Output is de-duplicated across engines, tied to persistent assets, and CVSS-normalized for triage.
- 06
Readable reports
Every run produces a diff and reports — executive, technical, and asset inventory — ready to share.
Trust
A defensible authorization trail
Ownership-verified targets
Every asset is proven yours — DNS TXT for names, signed attestation for IP space — before a packet is sent.
Signed authorization & rules of engagement
Intensity caps, rate limits, time windows, blackouts and expiry are signed. Any scope edit voids the signature.
Defense in depth + egress allow-list
Authorization is enforced at the API, the dispatcher, and the worker. Scan workers can reach nothing else on the network.
Append-only, hash-chained audit log
Every action is recorded in a tamper-evident chain you can verify — the backbone of a SOC 2 evidence program.
Controlled validation by authorization
Standard scans identify exposure. Optional, bounded validation requires separate signed authorization and enablement.
Pricing
Competitive pricing, no enterprise tax
Start watching your perimeter
Request early access and we'll get you set up with your first scope.
Request early access