External attack surface management in QS-WAN means one monitored profile and a scan pointed at it. You list the company name, the primary domain, the extra domains, the public IPs and the email addresses worth watching. Findings come back in six categories, at five severities, with a risk score out of 100 for each target.
The profile is the scope. Company name, primary domain, additional domains, public IPs, email addresses. That list is what gets scanned, so it is a thing you maintain, not a thing you file.
The depth is the trade. The shallowest is a quick pass and the deepest is a long one, and all three read the same profile.
Certificates, DNS and email authentication. The shallowest pass, and the fastest one.
Everything in Quick, plus vulnerabilities, exposed services and reputation.
Everything in Standard, plus data leaks, credentials and ransomware. It is the one that takes longest.
Findings land in six categories: Domains and Certificates, Vulnerabilities and Infrastructure, Data Leaks and Credentials, Reputation and Phishing, Malware and IOCs, and Ransomware. Each finding carries a severity, and each target carries a risk score out of 100.
Severity and score answer different questions. Severity is about one finding. The score is about one target, so a host with four moderate findings can outrank a host with one high one. Inside the fleet, that job belongs to risk scoring.
Press a depth and watch what the pass actually runs. The profile does not move, no port is opened, and nothing is installed on anything. What changes is how far the checks go.
The diagram reads left to right. On the left is the company profile, which defines what gets scanned on every run: company name, primary domain, additional domains, public IPs and email addresses. A channel carries the run out on a clock rather than on somebody remembering. In the middle are the three depths, with the description each one carries in the console: Quick runs certificates, DNS and email authentication; Standard adds vulnerabilities, exposed services and reputation; Deep adds data leaks, credentials and ransomware. On the right are the nine controls those descriptions name, in three groups, and each group is either running in this pass or waiting for a deeper one. Along the bottom, what comes back is a set of findings grouped by target, in six categories, at five severities, with a risk score out of 100 per target, and each scan can be compared with the one before it. The three buttons change the depth and nothing else: the profile does not move, no port is opened and nothing is installed on any machine.
The depth never changes the scope. All three passes read the same profile, so a Quick run and a Deep run disagree about how far they looked, never about what they were looking at. That is the part worth knowing before you pick one: a shallow pass is not a narrower list, it is a shorter question asked of the same list.
Certificate expiry on the public site is a check somebody does by hand, when they remember. The calendar reminder gets moved to next week, and next week it gets moved again.
The record that changed on the Tuesday is the one nobody looked at until the week after. Email authentication is the part that quietly stops matching.
You read it on a phone, then spend twenty minutes working out whether any of those addresses were yours, with no list to check them against.
There is no timestamp, because nothing wrote one. The honest answer is that somebody looked at some of it, at some point, and nobody wrote it down.
Certificate expiry on the public site, DNS that changed when the mail provider did, an address that surfaced in a credential dump: every one of those is a check you did by hand when you remembered, or heard about from somebody else.
The scan does them on a clock instead, against the same list every time.
The assessor asks what the company exposes and how you know it.
The answer is a profile, the scans run against it, and a score out of 100 per target next to the severities behind it. That trail becomes audit evidence without anybody assembling it.
Name, domains, public IPs, addresses. It is the only part that needs a person, and you are the person who knows which domains still matter.
Automatic scans go from every hour to once a day, with a depth of their own, set apart from the depth you pick when you run one by hand. The screen names the time of the next run.
Group by target or by severity, filter, acknowledge what you have seen. Each scan is compared with the one before it, so “what changed since Tuesday” is a view rather than a memory.
The phrase gets used for several different things, so here is the one it means on this page.
The email addresses in the profile are checked against public data-leak and credential databases, and matches show up under Data Leaks and Credentials.
Deep is the depth that runs it. Quick and Standard do not, which is the whole reason the depth is a choice and not a setting somebody forgot.
The honest boundary: that is public leak and credential data, matched against addresses you listed. If a vendor is selling you a crawler inside closed forums, this is not that.
When something has to come off somebody else’s server, the removal request goes out with the contact you set, your data protection officer or whoever holds that job, as the reply address. The reply reaches a named person, not a shared mailbox.
A calendar reminder moved to next week stops being the control. The shallowest depth carries certificates, DNS and email authentication, so the expiry is named by the pass rather than by whoever happened to look.
The scans stay in history and each one is compared with the one before it. Group by target or by severity, acknowledge what you have seen, and the question becomes a view instead of a memory.
There is no folder to assemble the night before. You open the scan history and the profile it ran against, and the answer is already written, because it was written while you were doing something else.
The removal request goes out with the contact you set, your data protection officer or whoever holds that job, as the reply address. The reply reaches a named person.
These are not a related links box. Each one owns a piece of the same question, and this page only answers the part of it that faces outwards.
This page scores what faces the internet, one target at a time. Inside the fleet, the same job belongs next door.
A finding here is a sentence. A rule there is scoped at gateway, user or device level and signed in the console before it reaches anything.
The scan reads certificates from the outside, the way anyone else on the internet does. The ones you issue yourself are handled here.
The outside view has a limit at the edge of what is public. The inside view starts there.
It also shows up twice in the main console: the Security Dashboard carries a card with the perimeter checks, and Threat Floor shows open exposure findings with how many sources each one came from. The console holds both, and every feature is listed in one place.
There is no QuantumNova analyst reading your findings at two in the morning. You run the product, and the scan is all it does on its own.
The profile is the scope. There is no discovery of assets you forgot, so the list deserves five minutes whenever something new goes live.
The removal request goes to the third party holding the data. Whether they act on it is theirs, and the product does not pretend otherwise.
It moves a finding out of your way, not off the internet, and it comes back if the next scan still finds it.
That tab pulls the industry picture from outside sources, including the public catalogue of actively exploited vulnerabilities. It is context for prioritising, never a statement about your own estate.
It names, scores and tracks. Enforcement is security policy management, certificates you issue yourself are certificate lifecycle management, and the inside view is network security monitoring.
External attack surface management is tracking what your organisation exposes to the internet, from the outside in. Here it is a monitored profile of domains, public IPs and email addresses, scanned at one of three depths, with findings in six categories, five severities and a score out of 100 per target.
Quick is a fast pass, Standard adds the vulnerability and reputation work, and Deep adds the leak and credential checks, which is why it is the longest of the three.
The addresses in your profile are checked against public data-leak and credential databases, and matches arrive under Data Leaks and Credentials. It is not a crawler inside closed forums.
Only if they are in the profile. Scope is the list you maintain, and the limit is deliberate: a scan that wandered is one you cannot put in front of an auditor.
An engineer, a console shaped like yours, and as long as you need. You write the profile, pick a depth, and watch the findings come back grouped by target with a score on each one. It is free and there is nothing to sign.
