Frequently asked questions

It continuously maps every domain, subdomain, IP, port, endpoint and cloud asset your organisation exposes to the internet, finds the weaknesses on them, and shows how it all connects, so your team knows what to fix first.

One seed domain. There are no agents to install.

Many tools give flat asset lists, raw scanner noise, one-off scans, PDF-only reports and software-only results. Surfacia maps how assets relate, prioritises what matters, scans on a schedule, exports clean data and validates findings with an AI engineer.

It takes the assets and weaknesses Surfacia has already mapped, attempts to exploit them in a controlled way, and confirms which are real. Every confirmed finding comes with evidence you can reproduce.

Yes. Testing is limited to the assets authorised for the engagement, and reports contain validated issues only, not raw scanner noise.

No. You do not need security engineers to run it or read its results. We operate the testing, and findings come with clear severity, evidence and remediation steps your developers can act on directly.

Yes. Reports come as PDF, with Excel for data, and there is an interlinked JSON export: one file per target with all recon data cross-referenced, for your own tools and automation.

Yes. Invite colleagues and clients with role-based access.