Subdomains
Shadow subdomains surfaced from passive sources and certificate transparency.
Find the assets you didn't know about
Subdomain discovery from certificate transparency logs and passive sources, plus ongoing checks for new subdomains and takeover risk on every paid tier. Every discovered asset lands in the same workflow as your scan results, so shadow IT becomes part of your security review.
Read-only access Working scan data deleted after each scan EU-hosted
The problem
You cannot scan what you cannot see
Attackers enumerate your subdomains whether or not you do. The only question is who finds the forgotten staging box first.
What discovery builds
One live inventory of discovered assets
Daily discovery combines active and passive scanning to keep your inventory current within the configured scope. Review new hosts alongside the service, certificate, and DNS findings from your scans.
Open services and ports
Exposed services, versions, and admin interfaces facing the internet.
Certificates and bindings
Expiring, mismatched, and weak certificates and where they are bound.
DNS posture
SPF, DKIM, DMARC, DNSSEC, and zone-transfer gaps that enable spoofing.
Detected technologies
See detected technologies on each host to assess relevant CVE alerts.
Takeover risk
Find dangling CNAMEs that may be vulnerable to subdomain takeover.
Scan the unknowns
Always-on
Attack surface management
Vornin runs a daily attack-surface sweep on top of your scheduled scans, surfacing new subdomains and forgotten dev environments, while your scheduled scans map the services they expose. Review what it finds, promote the assets you own into targets, and launch or schedule their scans. When a vulnerability becomes actively exploited, Vornin helps assess its relevance to your stack. Monitoring is built in, not sold as another product.
Example data
Hosts tracked
1,247
+14 new this week
IPs & services
89
12 open ports
Certificates
412
7 expire ≤30d
DNS posture
23
missing DMARC
Host
State
Open services
Flag
staging-old.nordhaven.io
CNAME → AWS
443, 8080
cert ≤14d
api-internal.nordhaven.io
new this week
443
cert valid
shop.legacy.nordhaven.io
takeover?
443 (SSL fail)
no DMARC
ci-cache.nordhaven.dev
dev / staging
22, 8080
no auth banner
internal-billing.nordhaven.io
tracked
443
cert valid
Prioritisation
A risk score that points, not decides
Every discovered asset carries a 0 to 100 risk score so you can sort the inventory by where to look first. The score is a signal, not a ruling, and discovery never acts on its own.
- A signal, not a verdict. The score blends severity, reachability, and EPSS exploit likelihood into a sort order. It tells you where to look first; it does not close the case for you.
- You choose what gets scanned. Discovery never auto-scans a neighbouring asset. Promoting a discovered host to a scanned target is an explicit step you take, with the asset kind you pick.
- Inventory that does not forget. Asset status moves New to Tracked to Ignored and never silently regresses, so a tracked host cannot vanish from the inventory on the next discovery run.
Discovered assets, including the forgotten subdomains that become breach paths, feed the same dedup, SLA, and compliance pipeline as the rest of your findings. See how that lifecycle works on the vulnerability management workflow.
Scan. Resolve. Prove.
Start monitoring your attack surface today
Add a domain and the daily monitor starts looking for subdomains you have not listed.
Read-only access Working scan data deleted after each scan EU-hosted