Attack Surface Management — In Development at Bachao.AI
We are building attack surface management. It is not running yet.
There is no discovery engine, no asset inventory, no dashboard and no monitoring schedule. This page is the plan, not the product.
What exists today
One check, and it lives inside our web application VAPT scan rather than in a product of its own. During a scan we resolve six common subdomain names — www, api, dev, staging, admin and mail — against the base domain, and raise a low-severity finding when a development, staging or admin host answers publicly. There is no brute-forcing, no certificate-transparency mining, no passive DNS, no port or technology fingerprinting per asset, and nothing is stored as an asset inventory. Nothing runs on a schedule and no alerts are sent. If you want that check run, book a VAPT scan — everything else on this page is work we have not done yet.
What we are building
The intended shape of the product. None of these are running — treat each as a roadmap item and ask us where it stands before you plan around it.
Planned: subdomain discovery
Certificate-transparency log mining, passive DNS and recursive enumeration are the intended approach. None of it is written. The only subdomain lookup that runs today is the six-name check inside a VAPT scan.
Planned: port & service mapping
Service and version fingerprinting across discovered hosts. Not built. Our cloud exposure scan probes a fixed list of 16 ports against a single host you name — that is a check, not asset discovery.
Planned: technology fingerprinting
Framework, CMS, WAF and CDN identification recorded per asset. Not built.
Planned: certificate monitoring
Expiry and weak-cipher alerting, and watching certificate-transparency logs for certificates issued against your domains. Not built — there is no scheduler, so nothing is being watched.
Planned: cloud asset discovery
Storage and database exposure across the cloud accounts you use. The nearest thing that exists is the external bucket check in our cloud exposure scan, which probes guessed bucket names for one domain.
Planned: asset risk ranking
Ranking discovered assets by exposure and business criticality so remediation has an order. There is no asset model in the product today, so there is nothing to rank.
Not packaged yet
Attack Surface Management is still being built, so there is no plan to sell you and no tier list worth printing. If it is close to what you need, talk to us — we will scope the work, tell you plainly what exists today, and quote only for that.
Technical FAQ
The questions your security team will ask — answered against the code, not the plan.
Can I buy attack surface management from Bachao.AI today?
No. There is no discovery engine, no asset inventory, no dashboard, no monitoring schedule and no alerting. Everything above under 'what we are building' is a plan. If you need continuous external discovery right now, we will say so on the call rather than sell you a roadmap.
What subdomain discovery do you actually perform?
Inside a web application VAPT scan we resolve six common subdomain names — www, api, dev, staging, admin and mail — against the base domain, and raise a low-severity finding when a development, staging or admin host answers publicly. There is no brute-forcing, no certificate-transparency mining and no passive DNS.
Do you monitor continuously or send alerts on new exposures?
No. Nothing is scheduled, nothing is compared between runs, and no webhook, email or SIEM alert is sent. A scan runs when someone books one.
Does discovery auto-trigger a VAPT scan or generate protection rules?
No. That orchestration does not exist in the product. A VAPT scan is booked and run on its own, and no rules are generated from its findings.
Explore more products
Bachao.AI covers your entire security surface — from code to cloud to compliance.
Attack surface management is not built yet
If continuous external discovery is what you are shopping for, tell us what you need. We will show you what runs today, say plainly what does not, and only quote for the part that exists.