HebeGuard maps the domains, cloud services and shadow IT you expose to the internet, then flags open services, leaked credentials and phishing sites in the order you should fix them.
Capabilities
Continuous attack surface monitoring, risk scoring and dark web monitoring, all working from the same live asset inventory.
External asset discovery for domains, subdomains, IPs, cloud assets and services, including shadow IT nobody signed off, kept in one live inventory.
Vulnerability prioritization by severity and exploitability, rolled into a 0–100 exposure score.
Leaked credentials, compromised employee accounts, IOCs and phishing infrastructure linked to your domains.
New assets, configuration changes, expiring SSL certificates and look-alike domains are flagged the day they appear.
The platform
From asset inventory to dark web monitoring, each view below is one part of the same exposure report.
The overview shows a single 0–100 exposure score, the five weighted sub-scores behind it, and signal cards for malware, phishing, reputation and brand-impersonation activity.
HebeGuard discovers the subdomains, IPs, URLs and open ports anyone can reach from the public internet, including shadow IT nobody told security about. Each host shows live/dead status, TLS grade and the service banner an attacker would fingerprint first.
WHOIS, DNS records, the full TLS certificate chain and hosting details, turned into the concrete routes an outsider could take from the open internet to a compromised host.
Findings are ranked by CVSS severity, known active exploitation and public-exploit availability, then matched with CVE data for your detected stack. Secrets exposed in the same crawl, such as API keys, show up here too.
Security headers, Content-Security-Policy, TLS configuration and DNSSEC, graded per host, so the gaps that make an exploit easier are as visible as the exploit itself.
Detections, threat-intel pulses, indicators of compromise and MITRE ATT&CK coverage, correlated across sources to show which campaigns and threat actors are touching your assets.
Brand protection and domain monitoring for typosquatting, homograph registrations, fake social channels and app-store clones. Each one comes with the DNS, logo-match and favicon-hash evidence behind it.
Dark web monitoring for exposure you can’t see from inside your network: corporate mailboxes in breach data, infostealer logs, onion-forum posts and paste-site dumps, each tied to the account, host or dataset at risk.
Phishing domain monitoring that combines live feeds, redirect-chain analysis, login-page inspection and signature rules to catch pages built to steal your users’ logins.
A single exposure score from five weighted layers, trended over time, with key findings, critical actions and positive signals written in plain language for leadership.
// illustrative data · demo tenant globex-demo.test · ten views, one linked report
Why it works
Agentless discovery, validated vulnerabilities and dark web monitoring in one exposure management console.
Findings roll up into one trend line, weighted by exploitability and mapped to ISO 27001 and PCI-DSS control families.
Scanning starts from a domain name. Nothing runs inside your network.
Branded client portals where each tenant sees only its own data.
New and changed exposures show up the day they appear.
Each finding is checked for reachability before it lands in your queue.
Leaked credentials, compromised employee accounts, combolists and look-alike domains, linked to the assets they put at risk.
The report
Everything above comes together in one exposure report per tenant, regenerated daily and exportable per module.
Weighted by exploitability, trended, mapped to controls.
6 CVEs confirmed reachable out of 26 findings before triage.
A scoped, branded report refreshed every day.
Each hit is tied to the asset it threatens.
Methodology
HebeGuard runs all five CTEM stages on a daily cycle, so your exposure data is current between audits.
↻ repeats continuously
ASM engine · simulation
How the HebeGuard attack surface management engine turns one domain into a ranked list of risks. Step through it, click any node for detail, or let it play.
The domains and brands you already know about.
Dark Web Monitoring
HebeGuard collects breach dumps, infostealer logs, pastes and onion-site mentions, keeps the records that name your domains or staff, checks they are real, and links each one to the asset it exposes.
New breach dumps, infostealer logs, paste drops and onion-site mentions are pulled in continuously from dark web, paste-site, code-repository and breach sources.
Filter that firehose down to only the records that name your domains, corporate mailboxes or brand.
domain · email · brandDe-duplicate, confirm each record is real and current, then grade every hit HIGH / MEDIUM / LOW.
confidence gradedLink each leak to the host, employee account or API key it exposes, and to any attack path it opens.
mapped to assetResults appear in the Dark Web Monitoring tab the same day, with evidence and a fix: rotate, reset or take down.
same-day · with remediationModules
Every module reads from the same asset inventory, so a leaked password, an open port and a look-alike domain all show up against the same host.
Live inventory of every internet-facing asset, subdomain and service.
Critical/High/Medium/Low findings with CVSS, known-exploited and exploit-available flags.
Leaked credentials, brand mentions and compromised-employee alerts.
Malicious infrastructure and look-alike domains targeting your brand.
One 0–100 exposure score, mapped to ISO 27001 / PCI-DSS.
Per-client scoped views with tracked remediation tasks and SLA alerts.
How it works
Three steps from a domain name to a prioritized, client-ready picture of your risk.
Enter a domain. No agent, no install, no firewall changes.
no agent · no install · no firewall change
Automated discovery maps your assets and services, then threat intelligence enriches each result.
Prioritized fixes, alerts and shareable client-ready reports.
Export client-ready report ▸
Why HebeGuard
An attacker enumerates your whole external surface. A typical agent-plus-scanner stack sees a fraction of it.
Who it's for
For in-house security teams, and for the MSSPs and vCISOs who manage external risk across many clients.
Run managed exposure programs across many clients with one platform, scoped reporting and branded client portals.
Track the external footprint of every subsidiary and brand, with one risk score and continuous monitoring.
Findings mapped to ISO 27001 and PCI-DSS controls, in reports you can hand straight to an auditor.
New subdomains and cloud services are picked up as you ship them, along with look-alike domains and leaked credentials.
FAQ
External attack surface management, often shortened to EASM or ASM, is the ongoing work of finding everything your organization exposes to the internet (domains, subdomains, IP addresses, cloud services, open ports and leaked credentials) and fixing the riskiest items first. HebeGuard automates the discovery and the ranking, and repeats both every day.
Subdomains, IP addresses, open ports and running services; SSL/TLS certificates and their expiry dates; DNS, SPF and DMARC records; security headers; subdomains at risk of takeover; exploitable vulnerabilities; typosquatting and look-alike domains; phishing pages; and leaked credentials on the dark web and paste sites.
Vulnerability scanners and penetration tests (VAPT) check the targets you hand them, usually once a quarter or once a year. Attack surface management starts from your domain name, finds assets you may not know about, and keeps checking them daily. Many teams use both: HebeGuard between tests, and VAPT for depth.
EASM (external attack surface management) is the discovery side: finding everything you expose to the internet. CTEM (continuous threat exposure management) is the wider program that also prioritizes, validates and fixes those exposures in a repeating cycle. HebeGuard does both, discovering your external assets and running the five CTEM stages on them every day.
Yes. Discovery works outward from your domain through certificate transparency logs, passive DNS and subdomain enumeration, so it finds sites and services nobody registered with IT. It also flags the third-party scripts and services your pages load, which are a common source of supply-chain risk.
It generates look-alike versions of your domain, including typos and homograph (Unicode) variants, and checks DNS to see which are registered and live. Live domains are compared against your logo and favicon, and phishing-intelligence feeds flag pages already serving phishing. It also watches certificate transparency logs, social media and app stores for accounts impersonating your brand. Together with dark web monitoring, this covers most of what digital risk protection (DRP) tools do.
Yes. All HebeGuard needs is your domain, so there is no agent to deploy and no infrastructure to run. It checks breach data, infostealer logs, paste sites and dark web sources for your domains and staff email addresses, and each alert names the exposed account and the fix, such as resetting a password.
Start with an accurate inventory, because you can’t secure assets you don’t know about. Then remove what you no longer need: old subdomains, test servers, dangling DNS records and unused open ports. Patch the exposed services attackers can exploit first, fix weak TLS and missing security headers, reset leaked credentials, and keep watching for new assets. HebeGuard handles the discovery and daily monitoring, and tells you which of these to do first.
No. HebeGuard works entirely from outside your network. You give us a domain and discovery starts. Nothing gets installed and no firewall rules change.
Each finding is weighted by severity, exploitability (CVSS score, known active exploitation and public exploit availability) and how exposed the affected asset is. Those roll up into one score that trends over time and maps to ISO 27001 and PCI-DSS control families.
Yes. The Client Portal is multi-tenant. Each client is a separate tenant with its own data, users and branded reports, and you manage all of them from one console.
Dark web and Tor sites, ransomware leak sites, paste sites, public code repositories and known breach data. Each record is matched against your domains and employee emails, so an alert names the specific account or host at risk.
Tenants are logically isolated, so one client can’t see another’s assets, findings or reports. You can run HebeGuard on your own server or use our hosted service.
Initial discovery and a first exposure score typically arrive within the first scan cycle. After that, monitoring is continuous and new exposures are flagged daily.
Yes. Scans run from the internet against your public-facing assets, so HebeGuard works the same for a company in Kuala Lumpur, Penang, Jakarta, Surabaya, Chennai or London. HebeSec Technologies has offices in Karaikudi, Tamil Nadu, India (+91 95660 22629) and Rawang, Selangor, Malaysia (+60 12-675 7536).
Malaysia’s amended Personal Data Protection Act (PDPA) and Indonesia’s Personal Data Protection Law (UU PDP, Law No. 27 of 2022) both require companies to report personal data breaches quickly. HebeGuard helps you find out early: it alerts you when staff or customer credentials appear in breach data, infostealer logs or paste sites, and shows which account or system is exposed. It does not replace legal advice on what to report.
Send us your primary domain. We'll map your external attack surface and walk you through what we find.