External assets & EASM

Ownership verification

Vertix never scans a public asset you haven't proven you own. Verification is by DNS TXT record or a well-known file on the domain, with guided steps and clear failure reasons.

• DNS TXT — add the provided record at the apex or subdomain
• Well-known file — serve a token file from the site itself
• Re-checked on a schedule — scanning auto-disables if the proof disappears
• Sensitive ranges (government, cloud metadata endpoints) are denylisted

What external scanning checks

• Subdomain enumeration (certificate transparency plus two additional sources) and takeover detection across 16 cloud/hosting providers
• Email security posture — SPF, DKIM, DMARC, MTA-STS, TLS-RPT, CAA
• Web security — headers, cookie flags, exposed files and panels (.git, .env, server-status), technology fingerprinting
• Risky exposure — internet-facing RDP, SMB, Telnet, VNC, FTP and database/cache ports
• TLS hygiene — expiry, hostname mismatch, self-signed, SHA-1, weak keys, TLS < 1.2

Score and change feed

Each organization gets a 0–100 external attack-surface score tracked over time, plus a change feed covering new subdomains, open ports, IP changes and newly detected technologies as they appear.