Open-source attack surface management: what to run yourself and when to pay
Open-source tools can map your external attack surface if someone owns the pipeline; this page lists the common ones and the point where a managed tool costs less than staff time.
Which open-source tools map an attack surface? Seven you will meet.
No single open-source tool maps and tracks an attack surface end to end. Most teams chain several of these. Each row says what the tool does and what you must still build around it.
| Tool | What it does | What you still build |
|---|---|---|
| Amass | Maps an organisation's external assets from public sources and active checks, centred on subdomain and network discovery. An OWASP project. | Scheduling, a place to keep results, comparison between runs and alerting. |
| Subfinder | Finds subdomains passively from public sources, quickly. A ProjectDiscovery tool. | Source API keys, deduplication, and anything beyond the list of names. |
| Nuclei | Runs template-based checks against hosts and web applications to find known flaws and misconfigurations. | Template curation, tuning out false positives and a rule for what may be scanned. |
| Nmap | Finds open ports and identifies the services behind them on hosts you point it at. | The list of hosts to scan, scheduling and storage of results over time. |
| reNgine | A web interface that runs a reconnaissance workflow by chaining other open-source tools and keeping the results. | Hosting and upgrading the application and its tool chain, and access control. |
| reconftw | A script that runs a long list of reconnaissance and scanning tools in sequence against a domain. | Installing and updating every tool it calls, storing output and reading very large result sets. |
| crossfeed | A platform built by the US Cybersecurity and Infrastructure Security Agency to scan the external footprint of many organisations at once. | Deployment on your own cloud account, upkeep, and a check that the project is still maintained. |
When does a managed tool cost less? When it saves more hours than it costs.
The tools carry no licence fee. The person who runs them is the cost. Use staff time as the test.
The rule: a managed tool costs less when its monthly price is lower than the staff time you spend running the open-source pipeline. Work it out in three steps.
- Add up the hours each month for scheduling runs, updating tools and templates, removing duplicates, checking false positives, storing history and writing the report.
- Multiply the hours by the loaded hourly cost of the person who does the work. Add hosting for the machine that runs it.
- Compare the total with the monthly price of the managed tool. The break-even point is the price divided by the hourly cost.
Illustration, not a quote. A tool priced at £400 a month, against a loaded cost of £50 an hour, breaks even at eight hours a month. If your pipeline takes more than eight hours a month to keep running, the tool costs less. Use your own figures.
Two other cases favour building. You may have an engineer who already maintains the tools as part of their job, so the extra hours are small. Or you may need checks that no managed tool offers. Neither case removes the need to count the hours.
What does each route cost? Line by line.
Compare the same lines for both routes. The open-source column is mostly time. The managed column is mostly price.
| Cost line | Open-source pipeline | Managed tool |
|---|---|---|
| Licence or subscription | No licence fee for the tools themselves. | A recurring price, set by the supplier. |
| Hosting | A server or cloud account to run the tools and keep results. | Included in the price. |
| Set-up | Days to choose tools, connect them and test the output. | Usually minutes to hours. |
| Monthly upkeep | Tool and template updates, broken integrations, API keys that expire. | Done by the supplier. |
| Reading the results | You deduplicate, filter and rank the output yourself. | Grouped by host and presented for you. |
| History and change tracking | You build storage and comparison between runs. | Varies. Check that it compares runs. |
| Support | Community channels and your own skills. | The supplier's support terms. |
What does EdgeProtect do, and what does it not? Plainly.
EdgeProtect is a managed tool with a narrower scope than a full open-source pipeline. Check these limits against what you need.
- It maps what is exposed. Subdomains, hosts, IP addresses, open ports, running services, certificates and known flaws in the services it finds, grouped by host.
- You can compare any two scans to see what appeared and what has gone, and export either as a PDF.
- Scans do not repeat by themselves. You start each one from your browser. If you need a schedule, you must run the scans yourself or call the API from your own scheduler.
- It scans only domains you have verified and never attacks anything. It does not run exploit templates the way Nuclei does.
- It checks staff email addresses against known breach data when a scan runs, and never shows the passwords.
For a closer look, read what an attack surface scan finds and the attack surface management guide. Current plans and credit amounts are on the pricing page.
It is mapping your internet-facing assets with open-source tools instead of a managed product. Common tools find subdomains, open ports, running services and known flaws. You choose the tools, run them on a schedule, keep the results and read them yourself.
Start with the question you need answered. Subfinder and Amass find names. Nmap finds open ports and services. Nuclei checks for known flaws. reNgine and reconftw chain several of these together, which saves effort but adds tools to maintain.
No. Only run them against systems you own or have written permission to test. Scanning other people's systems without authorisation can be an offence under the Computer Misuse Act 1990 in the UK. Check scope with whoever owns the target.
When its monthly price is lower than the staff time you spend running the pipeline. Divide the price by the loaded hourly cost of the person who does the work to find the break-even number of hours.
No. EdgeProtect maps what is exposed and lists known flaws in the services it finds. It does not run exploit templates, and it scans only domains you have verified. Scans do not repeat by themselves, so you start each one.
Count the hours before you choose.
If a scan from your browser covers what you need, you can compare it with your pipeline using the steps above.