External Surface Intelligence

Infrawatch sees the entire internet every day. External Surface Intelligence (ESI) aims that at one organisation: yours, or one you depend on. Declare the assets that belong to it, and every daily observation of those assets becomes a finding you can work. That applies as readily to a supplier as to yourself. The same inventory and detectors run against a vendor, a subsidiary, or an acquisition target, so the supply-chain risk you inherit is visible on the same terms as your own exposure, without waiting on a questionnaire.

What we find

DNS risks

Names still pointing at infrastructure you no longer control, followed to the end of the chain and grouped by provider.

Typosquatting

Look-alike domains scored by similarity, with a screenshot of what each one actually serves.

Secrets

Credential material found exposed on the surface, matched by fingerprint.

AI surface

MCP servers, LLM gateways, model runtimes, and agent endpoints exposed on your surface.

ESI is scoped to a project. Open the project that represents the organisation you are protecting, then work inside it.

The workspace

Section	What it answers
Dashboard	How large is the surface, and what changed recently
Findings	Everything raised across all detectors, in one queue
Inventory	What do we own, and what is waiting for review
DNS risks	Which names point at infrastructure we no longer control
Typosquatting	Who is imitating our domains and brands
Secrets	What credential material has leaked onto the surface
AI surface	What AI exposure do we have

Sections appear only when your access allows them, so a read-only analyst and a project manager see different workspaces.

Start with the inventory

Detectors only raise findings against assets in scope, so everything here follows from the inventory. Add the domains, addresses, ranges, and brands you can name, import the rest in bulk, and review the candidates Infrawatch discovers for you.

Build the inventory

Asset kinds, bulk import, the review queue, and the brand context that feeds impersonation detection.

Review findings

Every detector normalises to one finding row with the same lifecycle, so the actions are learned once and used everywhere.

Status	Meaning
`open`	Newly raised, not yet triaged
`accepted`	Real, and accepted as-is
`resolved`	The exposure has been fixed
`ignored`	Not worth acting on
`false_positive`	The detector was wrong

Reopening a finding returns it to open and clears the resolved metadata. DNS risks add one extra state, acknowledged, for a name you have seen but not yet dealt with. Select a batch and apply one status to as many as 500 findings at once. The batch is atomic: if a single identifier falls outside the active project, the whole request fails and nothing changes. Findings carry a severity, which is what you triage by:

Severity	Response
Critical	Act now
High	Act this cycle
Moderate	Plan the fix
Low	Track it
Informational	Context, no action implied

Each detector has its own page covering the evidence it collects and how to triage it. Typosquatting candidates and secret exposures are detector-owned: you cannot create one by hand, but you work them through the same lifecycle as everything else.

Access

ESI access resolves from your organisation, group, entitlement, credential, and project authorization together. An API key is limited to the project ceiling of the account that owns it.

Scope	Grants
`esi.inventory.manage`	Add, update, approve, ignore, and import assets
`esi.services.manage`	Create, update, and delete curated services
`esi.findings.view`	Read findings, including secrets
`esi.findings.manage`	Apply lifecycle actions and delete findings

Project managers keep access without those scopes, but manager access never widens what an API key can do. Check the project capabilities endpoint to see what the current credential actually has before building a workflow on it. ESI requests are rate-limited and consume monthly quota.

Open a project

Keep the surface, its findings, and analyst notes together.

Browse the ESI API

Inspect the inventory, service, and finding endpoints with full schemas.

Overview

Data products