External attack surface (EASM) FAQ

What is external attack surface management?

Nanitor's EASM feature lets you discover and monitor assets visible from outside your network. It uses Shodan, a public database of internet-connected devices, to look up information about your domains and public IP addresses. This is a passive lookup — Nanitor doesn't actively scan your infrastructure. Nanitor sends only your configured domains and public IP addresses to the Nanitor Hub, which resolves domains and queries Shodan on your behalf. You do not need a Shodan account.

You can enable it from Organization Management → Asset Policy → External Attack Surface. Scan targets and the grace period are configured separately for each organization; suborganizations do not inherit them.

For a full overview, see the user guide.

I enabled EASM but don't see any results

A few things to check:

Give it time. New targets are processed in the next daily scan, so initial results can take up to 24 hours to appear.
Save your targets. Targets you add stay pending until you select Save on the External attack surface page.
Check the External scan status table. The table on the same page shows what each target resolved to and what the scan found. See Why does a target show no results? below.
Shodan coverage. If your services are behind a CDN, WAF, or shared hosting, Shodan may not have data for them. You can verify coverage by searching for your domain or IP address on shodan.io directly.
Confirmation. Make sure you confirmed that you own the targets or are authorized to monitor them when enabling external scanning.

Why does a target show no results?

Open Organization Management → Asset Policy → External Attack Surface and look at the External scan status table. It lists every configured target, grouped by the IP addresses the target resolved to, with a Status column. Hover over a status to see its explanation. Common statuses:

No findings: The scan ran, but Shodan has no records matching this target. Nothing to fix in Nanitor: Shodan may not have scanned the target yet, the target may expose no services, or, for a domain, Shodan's records for its IP address do not name the domain.
No Shodan data: Shodan has no indexed host information for the IP address. Nothing to fix in Nanitor: Shodan may not have scanned the IP address yet, or it exposes no services.
Domain not resolved: The DNS lookup found no IP address. Check the domain name and its DNS records.
Domain lookup failed, IP lookup failed, Domain scan incomplete, or Target scan failed: The lookup could not be completed, so results may be incomplete. Wait for the next daily scan, and contact support if it persists.
CDN: The IP address belongs to a content delivery network. This is expected; CDN addresses are not created as assets. See How are CDN addresses handled?.

The table only shows results from within the grace period, and the Last scanned label above it shows when Nanitor last scanned.

Why aren't all my subdomains showing up?

EASM relies on Shodan's public database, which may not have scan data for all your subdomains. Shodan continuously scans the internet, but it doesn't guarantee coverage of every host. Common reasons a subdomain might be missing:

The subdomain is behind a CDN or WAF that blocks Shodan's scanners.
The host is on shared infrastructure that Shodan hasn't recently indexed.
The subdomain resolves to an IP address that Shodan hasn't scanned yet.
The subdomain resolves to a CDN IP address, which Nanitor doesn't create as an external asset.

This is a limitation of the underlying data source. Nanitor shows everything Shodan has for your domains.

Can I use IP addresses as targets?

Yes. You can add public IPv4 and IPv6 addresses as targets, in addition to domains. Private IP addresses and IP ranges aren't supported, and the entry can't include a protocol, path, or port. Each domain is also looked up by the IP address it resolves to. Domains are converted to lowercase automatically, so Example.com and example.com are the same target.

If a target shows no results, check the External scan status table as described above.

Where do I see vulnerabilities from external assets?

Results appear in two places:

Inventory → Assets — filter Assets by Source = External scan, or use the External assets filter (under More in the filter bar) and select Display external assets only, to see discovered external assets. Each asset shows IP address, reverse DNS, location, and open ports.
Issues — vulnerabilities detected on external assets show up here just like issues from internal assets. You can filter by asset source to focus on external findings.

In the asset details, Last confirmed shows the latest time Shodan observed the asset, and Last scanned by Nanitor shows when Nanitor last processed Shodan data for it.

How often does it update?

Daily: Nanitor checks your configured targets against Shodan's database every day.
Weekly (approximately): Shodan scans the IPv4 address space roughly once a week, so there can be up to one week of latency before new vulnerabilities or changes are reflected.

What's the difference between External and 360° visibility?

External assets can have two visibility levels:

External — the asset is only known from external sources. You see what an outside observer would see: open ports, services, and vulnerabilities based on externally detectable software versions.
360° Visibility — when you install a Nanitor Agent or Collector on an asset that was also discovered externally, it's upgraded to 360° Visibility. The matching is done by IP address — the agent's IP must match the external asset's IP exactly (this won't work through NAT or port forwarding). Once matched, you get both the external view and detailed internal configuration data. The agent's findings take precedence, and external-only vulnerabilities that are contradicted by more accurate internal data are automatically resolved.

If you're seeing external-only vulnerabilities on an asset you already monitor internally, installing an agent on it will give you the full picture and clear any false positives.

I'm seeing too many vulnerabilities / false positives

Shodan identifies vulnerabilities based on the software versions and services it detects. This can sometimes be imprecise — for example, a web server version might be flagged for CVEs that don't apply to your specific configuration.

A few ways to handle this:

Install an agent on the asset to get 360° Visibility. The agent's more accurate internal data takes precedence and automatically resolves false positives from external-only detection.
Use exception handling to dismiss specific vulnerability issues that you've verified as false positives. This works the same way as for internal issues.

Why does a closed port still show as open?

Shodan scans each IP address and port on its own schedule, so a port can disappear from the results temporarily even though it is still open. To avoid closing and reopening ports repeatedly, Nanitor resolves an external port once it has been missing from Shodan data for the Grace period. The default is 60 days.

If a port has really been closed, it is resolved once the grace period has passed. To change the period, enter a value from 1 to 365 days in the Grace period field on the External attack surface page and select Save. When you upgrade to 7.3.0, the grace period starts at the upgrade for all external ports that are open at that time. So a port that closed before the upgrade still shows as open for up to 60 days after the upgrade, unless you shorten the grace period.

Counts of open external ports can therefore include ports that closed within the grace period. Use the Last confirmed column in the External scan status table to tell current exposure from ports that are waiting to be resolved. The grace period applies only to open ports and their open-port issues; vulnerabilities found by external scanning are resolved as soon as a scan of the asset no longer reports them.

How are CDN addresses handled?

IP addresses that Shodan identifies as CDN infrastructure are not created as, or matched to, external assets, because Shodan may report the services of the CDN edge rather than those of your origin server. They are listed in the External scan status table with the CDN status. Assets and open ports that were already recorded for such an IP address are no longer updated by the scan. Like other inactive assets, they are archived by your archival rules or flagged for archival confirmation, and you can also archive them manually.

I archived an external asset but it came back / didn't come back

External assets that you manually archive won't be recreated by subsequent scans — this is by design. If you archive an external asset, Nanitor considers it intentionally dismissed.

If you want to re-discover an archived external asset, you'll need to unarchive it manually.

As always, if you have any issues or questions reach out to our support team. The link to the ticketing system is in the footer of this site.