Outside-in scan

Purpose

Build the first evidence in the tenant from the outside, with no credential and nothing installed. This is the run that turns an empty estate into certificates, algorithms and coverage.

Steps

1. Open Console › Analyst Console and find the Discovery scan card.
2. Mode — pick Real (queued) for a customer estate. Mock (instant) is rehearsal only and exposes a Rehearsal estate select (Default (pristine demo estate), UK MSP (~120 hosts, realistic mess), Defence subcontractor (~25 hosts, strict)). Mock rows are excluded from every board-facing figure.
3. Seed domains — one per line. Leave blank to use the organisation's configured seeds from the institution profile.
4. Scan level (real scans) — 0 — Public sources only reads certificate logs (crt.sh, Cert Spotter), Shodan, Censys and public DNS, and never connects to the domain's servers: no TLS, SSH or mail handshake, so key algorithm, TLS version and the post-quantum edge read Not measured — public sources only; handshake checks need the owner's consent. 1 — Consented handshake checks adds the probes below; use it only with the owner's consent. The default is 1 when every seed is one of your listed domains, else 0. The Quick check has the same selector (0 by default for a domain you have not listed), and the run history, the report and the audit log record the level.
5. Press Run scan. A real run queues and the button reports Scan queued. The worker will pick it up shortly.; a mock run completes in place.
6. Watch Run history below the card, then read the result on Inventory › Certificates, Inventory › Algorithms and Inventory › Discovery Coverage.

Operations › Quick check is not this. That screen is marked not saved to your inventory: it runs the same probe code in memory against one public domain — widening the probe with a fixed list of common subdomains, which a tenant scan never does — and returns a report, writing only a history line. It never files evidence in the tenant estate. A banner on it links back here. Do not start an engagement there.

What the screen shows

Discovery scan — a Model last refreshed line with the mode and status of the last run and its timestamp, or No scan yet.

Run history — discovery runs newest first, analyst-started and scheduled, with columns When · Mode · Trigger · Status · Hosts · Change · PQC edge. The Change column is the diff against the previous cycle. PQC edge reads X/Y hybrid for a real run (with the unknowns beside it) and — for a run that recorded none. Its empty state reads No runs yet — run a scan above to record the first one.

Latest real discovery scan — outside-in surface — the post-quantum edge, internet exposure and mail endpoints of the latest real run. The same card appears on Inventory › Discovery Coverage and on a Quick check report.

Scope: only hosts under the listed seed domains are ever contacted — the domain itself or a subdomain of it. A name from a shared certificate that sits under another domain is not this estate: it is dropped, counted (N discovered hosts were outside the listed domains and not contacted) and never probed. The scan invents no subdomain of its own.

Discovery reads two Certificate Transparency sources, crt.sh and SSLMate Cert Spotter; a host both saw is one row that records both. Per host it reaches it produces:

• the leaf certificate presented on the handshake — issuer, subject, validity window, serial;
• key algorithm and size, signature algorithm;
• TLS protocol version and the key exchange;
• post-quantum key exchange, measured by a second TLS 1.3 handshake that offers only the hybrid group (X25519MLKEM768, then SecP256r1MLKEM768): the handshake completes ⇒ hybrid; the server refuses ⇒ classical; no answer ⇒ unknown, never guessed. The method that answered is recorded on the row.

Mail endpoints. For each listed domain the scan reads its MX records. An MX host that is itself under a listed domain gets SMTP on 25 and 587 (greeting, EHLO, STARTTLS, TLS handshake, QUIT) and SMTPS 465 / IMAPS 993 (TLS handshake) — the same certificate, protocol and post-quantum reads as HTTPS. It never sends mail and never logs in. An MX hosted by a provider (Microsoft 365, Google, Mimecast …) is shown as mail hosted by <provider>, not probed and is never contacted.

Post-quantum edge — X of Y probed internet endpoints negotiate a hybrid post-quantum key exchange, over endpoints with a yes/no answer; endpoints whose answer is unknown are listed separately and counted on neither side.

Internet exposure — which sources were on for the run (crt.sh, Cert Spotter, TLS probe, SSH probe, mail probe, Shodan, Censys), exposed services grouped by port (RDP 3389 on 2 hosts), and outdated software only where Shodan reported vulnerabilities for it. Shodan and Censys need API keys; without them the card says they were not configured and that internet-wide exposure was not measured — never 0 findings.

Each certificate's page carries a Seen by line: every source that saw the host, with what each reported.

It also records DNS and e-mail posture per seed domain — SPF, DMARC, DKIM, CAA, DNSSEC — on the run itself rather than on a certificate, and Inventory › Certificates grades each endpoint from the handshake above.

Provenance

Egress

Real scans reach two Certificate Transparency services (crt.sh and SSLMate Cert Spotter — both receive the listed public domain names) and the customer's own hosts under the listed domains (:443, :22, and :25/:587/:465/:993 on in-scope mail hosts). The declared egress IP addresses for the deployed cluster are OPEN — not yet fixed or published. If a customer SOC asks for an allow-list entry, say OPEN and take the action; do not read them an address.

Common failures

• A real run sits at queued. Nothing is wrong with the scan; the worker process has not picked it up. Check the worker deployment. For a demonstration, fall back to the previous completed run rather than waiting.
• A host disappears from the run. The Run history states this outright: "Not observed" (−) means the scan did not see the host this cycle, not that it was decommissioned. Never report it as removed.
• Certificate Transparency is blocked or slow. One source down is fine: the run completes on the other and the card shows the down one as unreachable. With BOTH down the run fails as Discovery sources unreachable — an outage, never an empty estate.
• Port 25 reads "no answer". Many clouds block outbound SMTP; that is our egress, not the customer's mail server. Say so; do not report missing TLS.
• Seed box empty and no configured seeds. The run has nothing to scan. Set Public domains on Console › Onboarding.

Previous: Day 0 stand-up · Next: Inside estate import

All steps: Analyst method